CVE-2018-11763

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.17 through 2.4.34

Description The issue is related to insufficient input validation in the Apache HTTP Server, which can be exploited by a remote attacker to cause a denial of service by exhausting the limit of simultaneously open connections through continuous sending of maximum-sized SETTINGS frames. This affects only HTTP/2 connections.

Recommendations For Apache HTTP Server versions 2.4.17 through 2.4.34, a possible mitigation is to not enable the h2 protocol.