Skip to content
Fencer Vulns
medium 5.9

CVE-2023-45802 json

Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST

published 2023-10-23 3 y ago modified 2026-09-08 2 mo ago also BIT-apache-2023-45802 , EUVD-2023-50091

cvss
5.9
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.2%
EPSS 3.2% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that.

This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out.

Users are recommended to upgrade to version 2.4.58, which fixes the issue.

Patch / fix

  • bitnami apache 2.4.58
  • apache http_server 2.4.58
  • apache2 Debian 12 2.4.59-1~deb12u1
  • apache2 Debian 14, Debian 13 2.4.58-1

debian advisories DEBIAN-CVE-2023-45802

  • apache2 Ubuntu 20.04 LTS 2.4.41-4ubuntu3.15
  • apache2 Ubuntu 22.04 LTS 2.4.52-1ubuntu4.7
  • apache2 Ubuntu 24.04 LTS 2.4.58-1ubuntu1
  • apache2 Ubuntu Pro 18.04 LTS 2.4.29-1ubuntu4.27+esm7

ubuntu advisories UBUNTU-CVE-2023-45802

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • mod_http2 RHEL 9 2.0.26-1.el9
  • jbcs-httpd24-curl jboss core services 1 8.4.0-2.el7jbcs
  • jbcs-httpd24-curl jboss core services 1 8.4.0-2.el8jbcs
  • jbcs-httpd24-mod_jk jboss core services 1 1.2.49-1.redhat_1.el7jbcs
  • jbcs-httpd24-mod_jk jboss core services 1 1.2.49-1.redhat_1.el8jbcs
  • jbcs-httpd24-libcurl jboss core services 1 8.4.0-2.el7jbcs
  • jbcs-httpd24-libcurl jboss core services 1 8.4.0-2.el8jbcs
  • jbcs-httpd24-openssl jboss core services 1 1:1.1.1k-16.el7jbcs

red hat advisories RHSA-2024:2891RHSA-2024:2368RHSA-2023:7625RHSA-2024:3121

  • apache2 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 2.4.66-150400.6.57.1
  • apache2 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Module for Server Applications 15 SP6 +8 more 2.4.51-150400.6.43.1
  • apache2 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +4 more 2.4.51-150200.3.76.1
  • apache2 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Module for Server Applications 15 SP6 +8 more 2.4.51-150400.6.40.1
  • apache2 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 2.4.51-35.66.1
  • apache2-tls13 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 2.4.51-35.66.1

suse advisories SUSE-SU-2026:2686-1SUSE-SU-2024:3999-1SUSE-SU-2024:3962-1SUSE-SU-2024:3961-1SUSE-SU-2024:3949-1

  • apache2 openSUSE Tumbleweed 2.4.58-1.1

opensuse advisories openSUSE-SU-2024:13350-1

  • httpd AlmaLinux 8 2.4.37-64.module_el8.10.0+3761+75f8c656
  • mod_md AlmaLinux 8 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa
  • mod_md AlmaLinux 8 1:2.0.8-8.module_el8.6.0+3031+fb177b09
  • mod_ssl AlmaLinux 8 1:2.4.37-64.module_el8.10.0+3761+75f8c656
  • mod_ldap AlmaLinux 8 2.4.37-64.module_el8.10.0+3761+75f8c656
  • mod_http2 AlmaLinux 8 1.15.7-10.module_el8.10.0+3832+564e7653
  • httpd-tools AlmaLinux 8 2.4.37-64.module_el8.10.0+3761+75f8c656
  • mod_session AlmaLinux 8 2.4.37-64.module_el8.10.0+3761+75f8c656

almalinux advisories ALSA-2024:3121ALSA-2024:2368

  • httpd Rocky Linux 8 2.4.37-64.module+el8.10.0+1717+030a9fed
  • mod_md Rocky Linux 8 1:2.0.8-8.module+el8.9.0+1370+89cc8ad5
  • mod_http2 Rocky Linux 8 1.15.7-10.module+el8.10.0+1775+6b057638

rocky linux advisories RLSA-2024:3121

  • apache2 Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 2.4.58-r0

alpine advisories ALPINE-CVE-2023-45802

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • httpd CBL-Mariner 2.0 2.4.58-1
  • mod_http2 Azure Linux 3.0 2.0.29-3

azure linux advisories AZL-31611AZL-45147

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-45802 updated cvss 7.5

mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487)

  • Red Hat Enterprise Linux 6 httpd, mod_ssl, httpd-tools, httpd-manual Red Hat JBoss Enterprise Application Platform 6 httpd22 httpd22
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Software Collections httpd24, httpd24-build, httpd24-runtime, httpd24-scldevel
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux AppStream (v. 8) mod_md 2.0.8-8.module+el8.9.0+19080+567b90f8, httpd 2.4.37-64.module+el8.10.0+21332+dfb1b40e, mod_ssl 2.4.37-64.module+el8.10.0+21332+dfb1b40e, mod_ldap 2.4.37-64.module+el8.10.0+21332+dfb1b40e, mod_http2 1.15.7-10.module+el8.10.0+21653+eaff63f0, httpd-tools 2.4.37-64.module+el8.10.0+21332+dfb1b40e, +4 more
    fixed: vendor fix RHSA-2024:3121
  • Red Hat Enterprise Linux AppStream (v. 9) mod_http2 2.0.26-1.el9
    fixed: vendor fix RHSA-2024:2368
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) mod_md 2.0.8-8.module+el8.3.0+6814+67d1e611, httpd 2.4.37-56.module+el8.8.0+19808+379766d6.7, mod_ssl 2.4.37-56.module+el8.8.0+19808+379766d6.7, mod_http2 1.15.7-8.module+el8.8.0+21773+20528f83.5, mod_ldap 2.4.37-56.module+el8.8.0+19808+379766d6.7, httpd-tools 2.4.37-56.module+el8.8.0+19808+379766d6.7, +4 more
    fixed: vendor fix RHSA-2024:2891
  • Red Hat JBoss Core Services
    fixed: vendor fix RHSA-2023:7626
  • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-mod_http2 1.15.19-32.el7jbcs Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-mod_http2 1.15.19-32.el8jbcs
    fixed: vendor fix RHSA-2023:7625
  • Red Hat Enterprise Linux 7 httpd, mod_ssl, mod_ldap, httpd-tools, mod_session, httpd-manual, +1 more Red Hat Enterprise Linux 9 httpd, mod_lua, mod_ssl, mod_ldap, httpd-core, httpd-tools, +4 more Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl 8.4.0-2.el7jbcs, jbcs-httpd24-httpd 2.4.57-7.el7jbcs, jbcs-httpd24-libcurl 8.4.0-2.el7jbcs, jbcs-httpd24-mod_md 2.4.24-2.el7jbcs, jbcs-httpd24-mod_ssl 2.4.57-7.el7jbcs, jbcs-httpd24-mod_ldap 2.4.57-7.el7jbcs, +22 more Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl 8.4.0-2.el8jbcs, jbcs-httpd24-httpd 2.4.57-7.el8jbcs, jbcs-httpd24-libcurl 8.4.0-2.el8jbcs, jbcs-httpd24-mod_md 2.4.24-2.el8jbcs, jbcs-httpd24-mod_ssl 2.4.57-7.el8jbcs, jbcs-httpd24-mod_ldap 2.4.57-7.el8jbcs, +22 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-25-133-01 updated cvss 5.9

Hitachi Energy Service Suite

  • Hitachi Energy Service Suite <=9.8.1.3
    affected: fixed in 9.8.1.4
  • Hitachi Energy Service Suite 9.8.1.4
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

3.17% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami apache
>=2.4.17, <2.4.58
2.4.58

Affected products

  • Apache Software Foundation Apache HTTP Server

Classification

Weakness
  • CWE-404 Improper Resource Shutdown or Release
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.