In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that re

Summary

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.

Timeline

1. Jan 30, 2019, 10:00 PM UTCCVE published
2. Sep 17, 2024, 1:21 AM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache HTTP Server

  2.4.17 to 2.4.37

References 25