Loading vulnerability…
Apache HTTP Server HTTP/2 SETTINGS Frame Denial of Service
CVE-2018-11763 is a denial-of-service vulnerability in the HTTP/2 handling of Apache HTTP Server 2.4.17 through 2.4.34. A client can continuously send large, maximum-size HTTP/2 SETTINGS frames to keep a connection busy indefinitely without connection timeouts taking effect. Processing these frames occupies a server thread and consumes CPU time, potentially reducing service availability. Only HTTP/2 connections are affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can retain server connections and threads while consuming CPU resources, potentially exhausting processing capacity and degrading or denying service to legitimate clients. The vulnerability does not establish an ability to execute code, disclose information, or modify application data.
If you can’t patch tonight, do this now.
Disable the h2 protocol so that the server does not accept affected HTTP/2 connections. Ordinary connection timeouts do not stop the continuous SETTINGS-frame processing that triggers this vulnerability.
Patch, then assume compromise.
Upgrade Apache HTTP Server to version 2.4.35 or a later supported release containing the fix, or install the applicable vendor-backported update. For affected CIQ LTS 8.6 installations on Rocky Linux, update mod_http2 according to advisory ciqsa-2026_1605.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.