| Package | Affected versions | Patched versions |
|---|---|---|
| http server | = 2.4.17= 2.4.18= 2.4.20= 2.4.23= 2.4.25= 2.4.26= 2.4.27= 2.4.28= 2.4.29= 2.4.30= 2.4.33= 2.4.34= 2.4.35= 2.4.37 | |
| enterprise manager ops center | = 12.3.3 | |
| hospitality guest access | = 4.2.0= 4.2.1 | |
| instantis enterprisetrack | = 17.1= 17.2= 17.3 | |
| retail xstore point of service | = 7.0= 7.1 | |
| sun zfs storage appliance kit | = 8.8.6 | |
| jboss core services | = 1.0 |
In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free