CVE-2024-5055 Overview
CVE-2024-5055 is an uncontrolled resource consumption vulnerability affecting XAMPP for Windows versions 7.3.2 and earlier. The flaw triggers when XAMPP processes a large volume of incomplete HTTP requests, leading to resource exhaustion and system crashes. The weakness is categorized under [CWE-400] (Uncontrolled Resource Consumption).
A remote, unauthenticated attacker can reach the affected service over the network and disrupt availability without user interaction. Successful exploitation degrades or terminates the XAMPP service, impacting hosted web applications, databases, and development environments.
Critical Impact
Remote, unauthenticated attackers can crash XAMPP instances on Windows by sending streams of incomplete HTTP requests, causing denial of service to all hosted services.
Affected Products
- XAMPP for Windows version 7.3.2
- XAMPP for Windows versions earlier than 7.3.2
- Apache HTTP Server component bundled within affected XAMPP releases
Discovery Timeline
- 2024-05-17 - CVE-2024-5055 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2024-5055
Vulnerability Analysis
The vulnerability is a network-reachable denial of service condition in the XAMPP Windows distribution. The bundled web server fails to enforce limits or timeouts when handling streams of incomplete HTTP requests. Each partial request consumes connection slots, memory, and processing threads without releasing them.
An attacker who maintains many concurrent half-open requests forces the server to retain state for each connection. The accumulation of unfinished transactions exhausts available resources. Eventually, the XAMPP service halts or the underlying Windows host crashes, terminating all hosted services.
The EPSS probability is 0.443% with a percentile of 35.147, indicating limited observed exploitation activity at this time.
Root Cause
The root cause is improper handling of long-lived, incomplete HTTP transactions. The server does not impose effective request timeouts, header read deadlines, or per-client connection ceilings. This permits unbounded growth of in-memory request state.
Attack Vector
Exploitation occurs over the network against the HTTP listener exposed by XAMPP. The attacker opens many TCP connections and sends partial HTTP request headers or bodies without completing the transaction. This pattern mirrors classic slow-HTTP attack techniques such as Slowloris.
The attack requires no credentials, no user interaction, and no prior access to the host. Any reachable XAMPP instance with default configuration is exposed. Public references include the INCIBE Security Notice.
Detection Methods for CVE-2024-5055
Indicators of Compromise
- Sustained high counts of HTTP connections in the ESTABLISHED or SYN_RECEIVED state from a small set of source addresses.
- Apache error_log entries showing MaxRequestWorkers reached or server reached MaxClients setting warnings.
- Sudden growth in httpd.exe memory and handle counts followed by service termination.
- Client connections that send partial headers and never issue a terminating \r\n\r\n sequence.
Detection Strategies
- Monitor Apache access and error logs for repeated incomplete request entries and connection timeouts.
- Deploy network IDS signatures that flag slow-HTTP patterns, including Slowloris and Slow POST variants.
- Baseline normal concurrent connection counts per source IP and alert on statistical deviations.
Monitoring Recommendations
- Track Windows performance counters for httpd.exe thread count, handle count, and private bytes.
- Forward Apache and Windows Event Logs to a centralized SIEM for correlation across hosts.
- Alert on service restart events for the XAMPP Apache service outside of scheduled maintenance windows.
How to Mitigate CVE-2024-5055
Immediate Actions Required
- Upgrade XAMPP for Windows to a version later than 7.3.2 that includes the fix.
- Restrict network access to the XAMPP HTTP listener using Windows Firewall or perimeter controls, allowing only trusted source ranges.
- Place XAMPP behind a reverse proxy or web application firewall that enforces request completion timeouts.
- Disable or uninstall XAMPP on production-facing systems where it is not required.
Patch Information
Users should upgrade to a current XAMPP release that addresses the issue. Review the INCIBE Security Notice for vendor guidance and confirm the bundled Apache HTTP Server version is patched against slow-HTTP exhaustion.
Workarounds
- Enable and tune the Apache mod_reqtimeout module to enforce strict header and body read deadlines.
- Reduce Timeout and KeepAliveTimeout directives in httpd.conf to release idle connections quickly.
- Limit concurrent connections per source IP using mod_qos or a network-layer rate limiter.
- Restrict the XAMPP listener to 127.0.0.1 when used only for local development.
# Configuration example - httpd.conf hardening against slow HTTP attacks
LoadModule reqtimeout_module modules/mod_reqtimeout.so
<IfModule reqtimeout_module>
RequestReadTimeout header=10-20,MinRate=500
RequestReadTimeout body=10,MinRate=500
</IfModule>
Timeout 30
KeepAliveTimeout 5
MaxKeepAliveRequests 100
# Bind to localhost for development-only deployments
Listen 127.0.0.1:80
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
