CVE-2023-43622

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Oct 23, 2023
Updated: Nov 1, 2023
CWE ID 400

Summary

CVE-2023-43622 is a vulnerability in Apache HTTP Server versions 2.4.55 through 2.4.57, which allows an attacker to block the handling of an HTTP/2 connection indefinitely by opening the connection with an initial window size of 0. This can lead to the exhaustion of worker resources in the server, similar to a "slow loris" attack pattern. The issue has been fixed in version 2.4.58, which terminates such connections properly after the configured connection timeout. Users are advised to upgrade to this version to mitigate the vulnerability. The base severity of this vulnerability is rated as HIGH, with a CVSS score of 7.5, indicating its potential danger to organizations' availability.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-43622 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options