Critical Security Update for mod_http2: Addressing DoS Vulnerability in HTTP/2 Protocol
Summary
ALSA-2024:8680: Low: mod_http2 security update. Affects mod_http2 versions < 2.0.26-2.el9_4.1. Fixed in 2.0.26-2.el9_4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mod_http2 is an Apache HTTP server module that enables the implementation of the HTTP/2 protocol, enhancing web performance through multiplexing and header compression. It is built on top of libnghttp2 and is essential for modern web applications that require efficient data transfer. However, a recent vulnerability has been identified that could potentially compromise the stability of servers utilizing this module.
Vulnerability Detail
The vulnerability, identified as CVE-2024-36387, allows for a Denial of Service (DoS) attack through a null pointer dereference when using websockets over HTTP/2. This flaw can be exploited by an attacker to crash the server, leading to service unavailability. The issue arises from improper handling of certain requests, which can be triggered by maliciously crafted websocket connections.
How To Fix
Minimum fixed version
2.0.26-2.el9_4.1
This is the first release that contains the fix.
sudo dnf update mod_http2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the mod_http2 module until the update is applied. This can be done by executing the following command:
sudo a2dismod http2
After disabling, restart the Apache server using:
sudo systemctl restart httpd
This will prevent the exploitation of the vulnerability until a proper fix is implemented.
Conclusion
The mod_http2 module has a critical vulnerability that can lead to Denial of Service attacks. It is essential to update to the patched version to ensure the security and stability of your web server. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for mod_http2 →
FAQ
mod_http2 is an Apache module that implements the HTTP/2 protocol, allowing for improved performance and efficiency in web communications.
CVE-2024-36387 is the identifier for a security vulnerability in mod_http2 that can lead to Denial of Service attacks through null pointer dereference.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software, by simply uploading your manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
Failure to address this vulnerability may result in server crashes and unavailability, impacting the user experience and potentially leading to loss of revenue.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities, allowing you to stay informed about potential risks in your software.
Related vulnerabilities
Recent vulnerabilities recorded for mod_http2.
