Allocation of Resources Without Limits in Apache HttpComponents Core HTTP/2 HPACK Decoder

Executive Summary

This vulnerability exists in the HTTP/2 HPACK decoder of Apache HttpComponents Core versions 5.4.2 and earlier, as well as 5.5-beta1 and earlier. It occurs because the decoder allocates resources without any limits or throttling.

An attacker can exploit this by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement is processed. This prevents the configured header list size limit from being applied, allowing the attacker to cause memory exhaustion.

As a result, this can lead to a denial-of-service (DoS) condition on the affected server.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a remote attacker to cause a denial-of-service (DoS) condition on your server running vulnerable versions of Apache HttpComponents Core.

The attacker achieves this by exhausting the server's memory through sending oversized compressed HTTP/2 header blocks before the SETTINGS acknowledgement is processed, which prevents the application of header size limits.

This can lead to service unavailability, potentially disrupting your applications or services that rely on this component.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability affects Apache HttpComponents Core versions 5.4.2 and earlier, as well as 5.5-beta1 and earlier. To mitigate this vulnerability, you should upgrade to a version later than these affected releases where the issue in the HTTP/2 HPACK decoder is fixed.

Since the vulnerability is caused by resource allocation without limits or throttling, applying any available patches or updates from Apache that address this issue is recommended to prevent denial of service through memory exhaustion.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0