DoS for HTTP/2 connections by crafted requests

Summary

By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33).

Timeline

1. Jun 18, 2018, 6:00 PM UTCCVE published
2. Sep 17, 2024, 4:09 AM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache HTTP Server

  Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33)

References 21