CVE-2018-17189: apache software foundation apache http server Uncontrolled Resource Consumption
Vulnerability summary
CVE-2018-17189 is a medium (CVSS 5.3) Uncontrolled Resource Consumption vulnerability in apache software foundation apache http server. EPSS estimates a 20.07% chance of exploitation in the next 30 days, higher than 97.4% of scored vulnerabilities.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 10 · Related 4Timeline
- 30-01-2019PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
20.07%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
No change 0.00 pp
From 20.07% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Oracle5 products
- enterprise_manager_ops_center12.3.3
- hospitality_guest_access4.2.0 | 4.2.1
- instantis_enterprisetrack17.1 | 17.2 | 17.3
- retail_xstore_point_of_service7.0 | 7.1
- sun_zfs_storage_appliance_kit8.8.6
Debian2 products
- apache2< 2.4.38-1
- debian_linuxEOL9.0
Netapp2 products
Alpine1 product
- apache2< 2.4.38-r0
Apache1 product
- http_server2.4.17 | 2.4.18 | 2.4.20 | 2.4.23 | 2.4.25 | 2.4.26 | 2.4.27 | 2.4.28 | 2.4.29 | 2.4.30 | 2.4.33 | 2.4.34 | 2.4.35 | 2.4.37
Apache software foundation1 product
- apache http server2.4.17 to 2.4.37
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10
Fedoraproject1 product
- fedoraEOL28 | 29
Redhat1 product
Ubuntu1 product
- apache2< 2.4.29-1ubuntu4.6
10 vendors · 16 products
References
36 links
- www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlX Refsource MISCThird Party Advisory
Show all 36 references
- www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlX Refsource MISCThird Party Advisory
- support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_usX Refsource CONFIRMThird Party Advisory