CVE-2019-0197

httpd: mod_http2: possible crash on late upgrade

Loading…

Severity

Low

Red Hat Product Security

4.2

CVSS 3.0

Review impact separately from score.

Published · February 1, 2019

Updated · September 21, 2026

Description

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 4.2
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')