| Package | Affected versions | Patched versions |
|---|---|---|
| http server | ≥ 2.4.17, ≤ 2.4.34 | |
| enterprise manager ops center | = 12.3.3 | |
| hospitality guest access | = 4.2.0= 4.2.1 | |
| instantis enterprisetrack | = 17.1= 17.2= 17.3 | |
| retail xstore point of service | = 7.0= 7.1 | |
| secure global desktop | = 5.4 |
In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free