Memory Exhaustion in Apache2 HTTP/2
Summary
CVE-2024-27316: HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. Affects apache2 across 2 version ranges.
< 2.4.59-r0
>= 47a9d8e8abf5697b4580c3ee2ade302b5c058fa6, < a751ae5cf6890cfd477f253390d09186386ea988
Fixed in 2.4.59-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache2 is a popular open-source web server software that is widely used for hosting websites. It provides a robust and scalable platform for serving HTTP and HTTPS requests. The HTTP/2 protocol is supported by Apache2 and offers improved performance and efficiency compared to its predecessor. However, a vulnerability has been discovered in Apache2's HTTP/2 implementation that can lead to memory exhaustion.
Vulnerability Detail
The vulnerability (CVE-2024-27316) occurs when HTTP/2 incoming headers exceed the limit set by nghttp2, a library used by Apache2 for HTTP/2 support. In order to generate an informative HTTP 413 response, the excess headers are temporarily buffered. However, if a client continues to send headers without stopping, this can result in memory exhaustion. This vulnerability can be exploited by an attacker to consume excessive memory resources on the server, potentially leading to denial-of-service (DoS) conditions.
How To Fix
Minimum fixed version
2.4.59-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Apache2 is not immediately feasible, a temporary workaround can be implemented by disabling the HTTP/2 protocol. This can be achieved by modifying the server configuration to remove or comment out the relevant directives related to HTTP/2. However, it is important to note that disabling HTTP/2 may impact the performance and efficiency benefits provided by the protocol.
Conclusion
In conclusion, the memory exhaustion vulnerability in Apache2's HTTP/2 implementation can be mitigated by updating to version 2.4.59-r0 or later. Disabling HTTP/2 temporarily can serve as a workaround until the update can be applied. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
Apache2 is an open-source web server software that is widely used for hosting websites. It provides a robust and scalable platform for serving HTTP and HTTPS requests.
HTTP/2 is a protocol that offers improved performance and efficiency compared to its predecessor, HTTP/1.1. It allows for multiplexing, header compression, and server push, among other features.
nghttp2 is a library used by Apache2 for HTTP/2 support. It handles the processing of HTTP/2 requests and responses, including header compression and flow control.
The vulnerability can lead to memory exhaustion on the server, potentially resulting in denial-of-service (DoS) conditions. This can impact the availability and performance of the affected Apache2 server.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Apache2 installation is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
