--- title: "CVE-2023-45802\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2023-45802?format=md keywords: index, follow --- # CVE-2023-45802 Publication date 23 October 2023 Last updated 2 June 2026 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **5.9 · Medium** [Score breakdown](https://ubuntu.com/security/CVE-2023-45802?format=md#impact-score) Toggle side navigation ## Description When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue. [Read the notes from the security team](https://ubuntu.com/security/CVE-2023-45802?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | apache2 | 26.04 LTS resolute | Fixed 2.4.58-1ubuntu1 | | 25.10 questing | Fixed 2.4.58-1ubuntu1 | | 25.04 plucky | Fixed 2.4.58-1ubuntu1 | | 24.10 oracular | Fixed 2.4.58-1ubuntu1 | | 24.04 LTS noble | Fixed 2.4.58-1ubuntu1 | | 23.10 mantic | Fixed 2.4.57-2ubuntu2.1 | | 23.04 lunar | Fixed 2.4.55-1ubuntu2.1 | | 22.04 LTS jammy | Fixed 2.4.52-1ubuntu4.7 | | 20.04 LTS focal | Fixed 2.4.41-4ubuntu3.15 | | 18.04 LTS bionic | Fixed 2.4.29-1ubuntu4.27+esm7 Ubuntu Pro | | 16.04 LTS xenial | Not affected | | 14.04 LTS trusty | Not affected | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) * [Patch details](https://ubuntu.com/security/CVE-2023-45802?format=md#patch-details) ### Get expanded security coverage with Ubuntu Pro Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use. [Get Ubuntu Pro](https://ubuntu.com/pro) [30-day free trial](https://ubuntu.com/pro/free-trial) ## Notes --- ### [mdeslaur](https://launchpad.net/~mdeslaur) backporting this to jammy and earlier will likely require backporting the whole 2.0.10 version of the http/2 module as it refactors how connections and streams are handled: https://github.com/apache/httpd/commit/9767274b884a110e9244f59f50bd31ff1cae2933 ### Patch details For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) | Package | Patch details | | --- | --- | | apache2 | * Upstream: [decce82](https://github.com/apache/httpd/commit/decce82a706abd78dfc32821a03ad93841d7758a) * Upstream: [3c6caeb](https://github.com/apache/httpd/commit/3c6caeb2dc865bd08bf53a06844efe2f8c8c70bb) | ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 5.9 · Medium * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | High | | Privileges required | None | | User interaction | None | | Scope | Unchanged | | Confidentiality impact | None | | Integrity impact | None | | Availability impact | High | * Scores | Parameter | Value | | --- | --- | | Base score | 5.9 · Medium | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45802) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-45802) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2023-45802) * [Debian](https://security-tracker.debian.org/tracker/CVE-2023-45802) ### Related Ubuntu Security Notices (USN) + [USN-6506-1](https://usn.ubuntu.com/USN-6506-1) + Apache HTTP Server vulnerabilities + 22 November 2023 + [USN-8338-1](https://usn.ubuntu.com/USN-8338-1) + Apache HTTP Server vulnerabilities + 28 May 2026 ### Other references * * * *