CVE-2024-36387
Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2
Summary
Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2
Original description
The description as published by the source.
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.
Affected packages
Bitnami
apache
[{"type":"SEMVER","events":[{"introduced":"2.4.55"},{"fixed":"2.4.60"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2024-36387 apache2 Fixed in: 2.4.60-r0
- Debian DEBIAN-CVE-2024-36387 apache2 Fixed in: 2.4.61-1~deb11u1
References
- advisory httpd.apache.org
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com
- web openwall.com