---
title: "WEB-APA-011 Apache Has No Slow Request Protection"
canonical: https://openvapt.com/checks/WEB-APA-011.html
html: https://openvapt.com/checks/WEB-APA-011.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-APA-011 Apache Has No Slow Request Protection

mod_reqtimeout does not appear to be loaded and no RequestReadTimeout is set, so a client that sends its request very slowly can hold a worker for the whole Timeout.

- Domain: Web Apps
- Severity: Medium
- Control category: Secure Configuration
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`
- CIS Controls v8: 16.7
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-770
- OWASP Top 10 2021: A05:2021
- NIST SP 800-53 Rev. 5: SC-5, CM-6
- Benchmark topic: Web server request time limits (topic only, no benchmark text)

## Why It Matters

Apache keeps one worker busy for each open request. Without minimum read rates, a few clients sending headers a byte at a time (the Slowloris technique) can use up every worker and take the site offline. The module is enabled by default on most distributions, so its absence usually means it was removed.

## How It Detects

Looks for LoadModule reqtimeout_module or a RequestReadTimeout directive in the configuration tree, or reqtimeout.load under mods-enabled. A module compiled into the server binary does not appear in the configuration, so confirm with the Verify command. Configuration is only read; no slow request is sent.

## How to Fix

Enable the module (Debian and Ubuntu: a2enmod reqtimeout; other systems: LoadModule reqtimeout_module modules/mod_reqtimeout.so) and keep or set  RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500 , then reload.

## How to Verify

```
apachectl -M 2>/dev/null | grep reqtimeout
```

## Learn the Theory

- [P18 Web Server Hardening: nginx and Apache](https://openvapt.com/academy/p18.md)
- [P25 Availability Without Load Testing](https://openvapt.com/academy/p25.md)

## References

- [Apache HTTP Server, mod_reqtimeout](https://httpd.apache.org/docs/2.4/mod/mod_reqtimeout.html)
- [Apache HTTP Server, Security Tips](https://httpd.apache.org/docs/2.4/misc/security_tips.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go

Run it: `openvapt scan --only WEB-APA-011`. Read it offline: `openvapt explain WEB-APA-011`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-APA-011.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.