Description

The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service (stream-processing outage) via modified flow-control windows.

Remediation

References

CVE-2016-1546

Related Vulnerabilities

WordPress Plugin Import all XML, CSV & TXT into WordPress Security Bypass (6.4.1)

PHP Improper Input Validation Vulnerability (CVE-2007-0908)

WordPress Plugin WooCommerce Zoho Integration-CRM, Books, Invoice, Inventory Cross-Site Scripting (1.2.3)

Magento Violation of Secure Design Principles Vulnerability (CVE-2021-28583)

WordPress Plugin NextScripts:Social Networks Auto-Poster Unspecified Vulnerability (4.3.2)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities CVE-2016-1546