Apache HTTP/2 Denial of Service Vulnerability

The Apache HTTP/2 protocol is a modern HTTP/1.1 replacement that allows for more efficient and secure communication between servers and clients. However, this vulnerability allows remote attackers to conduct a denial of service by sending a large number of MIME headers.

You're affected if you use Apache HTTP Server version 2.4.10 or earlier (not specified in the advisory). Check with: grep "HTTP/2" /etc/apache2/httpd.conf or find / -name "httpd*.conf" to verify your server configuration.

1. Upgrade to Apache HTTP Server version 2.4.11 or later from the official Apache website: https://www.apache.org/dist/httpd/source/2.4.11.tar.gz
2. Alternatively, you can apply a patch by applying the following patch to your httpd.conf file:

# Apply the patch to your httpd.conf file
sed -i '/^#LoadModule http2\/module/ { s/.*$/ #LoadModule http2\/module / }' /etc/apache2/httpd.conf

• Vendor Advisory
• Vendor Advisory