CVE-2016-8740
CVE-2016-8740
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.
CVSS 7.5 · High · EPSS 79.1% · Public exploit · Fix available
- Published
- Updated
Affected products and versions
apache httpd
- Versions
- 2.4.17 - 2.4.23: Affected
No fix published
apache2 Debian:12
- Affected ranges
- ECOSYSTEM: < 2.4.25-1
Update to 2.4.25-1
apache2 Debian:13
- Affected ranges
- ECOSYSTEM: < 2.4.25-1
Update to 2.4.25-1
apache2 Debian:14
- Affected ranges
- ECOSYSTEM: < 2.4.25-1
Update to 2.4.25-1
Original sources
- https://support.apple.com/HT208221
- https://github.com/apache/httpd/commit/29c63b786ae028d82405421585e91283c8fa0da3
- http://www.securitytracker.com/id/1037388
- http://packetstormsecurity.com/files/140023/Apache-HTTPD-Web-Server-2.4.23-Memory-Exhaustion.html
- https://access.redhat.com/errata/RHSA-2017:1413
- https://access.redhat.com/errata/RHSA-2017:1161
- https://www.tenable.com/security/tns-2017-04
- https://access.redhat.com/errata/RHSA-2017:1414
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us
- https://www.exploit-db.com/exploits/40909/
- http://rhn.redhat.com/errata/RHSA-2017-1415.html
- http://www.securityfocus.com/bid/94650
- https://security.gentoo.org/glsa/201701-36
- https://security.netapp.com/advisory/ntap-20180423-0001/
- https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2016-8740