CVE-2018-17189: Apache HTTP Server

Medium severity, CVSS 5.3. EPSS: 20.1% chance of exploitation in the next 30 days.

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.

Affected products

• Apache HTTP Server: version 2.4.17 only; version 2.4.18 only; version 2.4.20 only; version 2.4.23 only; version 2.4.25 only; version 2.4.26 only; …
• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only; version 18.10 only
• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 28 only; version 29 only
• Netapp Santricity Cloud Connector: affected versions not specified
• Netapp Storage Automation Store: affected versions not specified
• Oracle Enterprise Manager Ops Center: version 12.3.3 only
• Oracle Hospitality Guest Access: version 4.2.0 only; version 4.2.1 only
• Oracle Instantis Enterprisetrack: version 17.1 only; version 17.2 only; version 17.3 only
• Oracle Retail Xstore Point Of Service: version 7.0 only; version 7.1 only
• Oracle Sun ZFS Storage Appliance Kit: version 8.8.6 only
• Red Hat JBoss Core Services: version 1.0 only

Published 2019-01-30. Last modified 2026-06-17.