Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2023-33141: Apache HTTP Server Denial of Service via Reverse Proxy
CVE-2023-33141 · published 3 years ago
Summary
A flaw in the Apache HTTP Server's reverse proxy module can cause the server to consume excessive resources, leading to a denial of service. This affects Apache servers that use reverse proxy functionality, which can impact the availability of websites and online services. Updates are available to address this issue.
What to do
- Update microsoft yarp.reverseproxy to version 1.1.2.
- Update microsoft yarp.reverseproxy to version 2.0.1.
- Update microsoft yet_another_reverse_proxy to version 1.1.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| nuget | microsoft | yarp.reverseproxy |
<= 1.1.1 2.0.0 Fix: upgrade to 1.1.2
|
| – | microsoft | yet_another_reverse_proxy |
>= 1.0.0, < 1.1.2 2.0.0 cpe:2.3:a:microsoft:yet_another_reverse_proxy:*:*:*:*:*:*:*:* |
Original advisory text
Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability
Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability
References
- https://github.com/microsoft/reverse-proxy/security/advisories/GHSA-jrjw-qgr2-wf...
- https://nvd.nist.gov/vuln/detail/CVE-2023-33141
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33141
- https://www.nuget.org/packages/Yarp.ReverseProxy/1.1.2
- https://www.nuget.org/packages/Yarp.ReverseProxy/2.0.1
- https://github.com/advisories/GHSA-jrjw-qgr2-wfcg
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published23 Jun 2023
Updated29 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta