What’s Vulnerable › Vulnerabilities

CVE-2018-11763

• Severity: medium (CVSS 5.9 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 50.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-09-25 · updated 2026-06-17

Description

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.

Affected products

• Apache HTTP Server: from 2.4.17 through 2.4.34
• Canonical Ubuntu Linux: 18.04
• NetApp Storage Automation Store: all versions
• Oracle Corporation Enterprise Manager Ops Center: 12.3.3
• Oracle Corporation Hospitality Guest Access: 4.2.0, 4.2.1
• Oracle Instantis Enterprisetrack: 17.1, 17.2, 17.3
• Oracle Corporation Retail Xstore Point of Service: 7.0, 7.1
• Oracle Corporation Secure Global Desktop: 5.4
• Red Hat Enterprise Linux: 6.0, 7.0, 7.4, 7.5, 7.6

References

• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html
• http://www.securityfocus.com/bid/105414
• http://www.securitytracker.com/id/1041713
• https://access.redhat.com/errata/RHSA-2018:3558
• https://access.redhat.com/errata/RHSA-2019:0366
• https://access.redhat.com/errata/RHSA-2019:0367
• https://httpd.apache.org/security/vulnerabilities_24.html
• https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E

Get alerted when CVE-2018-11763 or the next vulnerability affects your stack