HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
| Link | Tags |
|---|---|
| https://httpd.apache.org/security/vulnerabilities_24.html | product vendor advisory release notes |
| https://www.openwall.com/lists/oss-security/2024/04/03/16 | |
| http://www.openwall.com/lists/oss-security/2024/04/04/4 | mailing list |
| https://support.apple.com/kb/HT214119 | |
| http://seclists.org/fulldisclosure/2024/Jul/18 |