Apache HTTP Server Vulnerability: Slow Loris Attack on HTTP/2 Connections

apache2 Updated 02 Oct 2025

Summary

30/01/2019

Disclosed on

N/A

Severity

Yes i

Fix available

Medium

Severity

5.3

CVSS Score

ALPINE-CVE-2018-17189: In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. Affects apache2 versions < 2.4.38-r0. Fixed in 2.4.38-r0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache HTTP Server is a widely used open-source web server software that enables users to serve web content. It is known for its flexibility, power, and extensive feature set, including support for various protocols and modules. The vulnerability in question affects versions 2.4.37 and earlier, specifically targeting the HTTP/2 protocol (mod_http2). This vulnerability allows attackers to exploit the server by sending request bodies in a slow loris manner, which can lead to resource exhaustion and denial of service.

Vulnerability Detail

The vulnerability, identified as CVE-2018-17189, arises from the way Apache HTTP Server handles incoming data for HTTP/2 connections. By sending data slowly, an attacker can occupy server threads unnecessarily, leading to performance degradation and potential denial of service. This issue is particularly concerning for servers handling multiple concurrent connections, as it can exhaust available resources and disrupt legitimate traffic.

How To Fix

Minimum fixed version

2.4.38-r0

This is the first release that contains the fix.

sudo apk add --upgrade apache2

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a temporary workaround, you can limit the number of concurrent HTTP/2 connections or implement rate limiting on incoming requests to mitigate the effects of this vulnerability until a patch is applied.

Conclusion

The CVE-2018-17189 vulnerability in Apache HTTP Server poses a significant risk to servers utilizing the HTTP/2 protocol. It is crucial to update to the patched version to mitigate potential denial of service attacks. Users should also consider temporary workarounds while planning for the update.

See every vulnerability recorded for apache2 →