|Description||HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)|
|NVD severity||medium (attack range: remote)|
Vulnerable and fixed packages
The table below lists information on source packages.
|stretch (security), stretch||2.4.25-3+deb9u8||fixed|
|buster, buster (security)||2.4.38-3+deb10u1||fixed|
The information below is based on the following data on fixed versions.
[jessie] - apache2 <not-affected> (HTTP/2 support only available since version 2.4.17 and later)
Affects upstream versions 2.4.20 to 2.4.39