The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | alpine-linux-upgrade-apache2 | Aug 30, 2017 | Jul 27, 2017 |
| Apache Httpd | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | apache-httpd-upgrade-latest | Dec 5, 2016 | Dec 5, 2016 |
| Apple Osx Apache | apple-osx-security-update-2017-001-sierraapple-osx-security-update-2017-004-el-capitanapple-osx-upgrade-latest | Mar 28, 2017 | Dec 5, 2016 | |
| Debian | debian-upgrade-apache2 | Jul 30, 2024 | Dec 5, 2016 | |
| Freebsd | freebsd-upgrade-package-apache24freebsd-upgrade-package-mod_http2-devel | Dec 21, 2016 | Dec 21, 2016 | |
| Gentoo Linux | gentoo-linux-upgrade-www-servers-apache | Oct 30, 2017 | Dec 5, 2016 | |
| Hpux | — | hpux-update-hpuxws24apache-apachehpux-update-hpuxws24apache-apache2hpux-update-hpuxws24apache-auth_ldaphpux-update-hpuxws24apache-auth_ldap2hpux-update-hpuxws24apache-mod_jkhpux-update-hpuxws24apache-mod_jk2hpux-update-hpuxws24apache-mod_perlhpux-update-hpuxws24apache-mod_perl2hpux-update-hpuxws24apache-webproxyhpux-update-hpuxws24apache-webproxy2 | Aug 11, 2017 | Dec 5, 2016 |
| Ibm Http_server | — | ibm-http_server-apply-fix-pack-9_0_0_3 | Jun 22, 2018 | Dec 5, 2016 |
| Oracle Solaris | oracle-solaris-11-3-upgrade-web-server-apache-24-2-4-25-0-175-3-17-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-dbd-2-4-25-0-175-3-17-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-gss-2-4-25-0-175-3-17-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ldap-2-4-25-0-175-3-17-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-lua-2-4-25-0-175-3-17-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ssl-2-4-25-0-175-3-17-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ssl-fips-140-2-4-25-0-175-3-17-0-3-0 | May 29, 2017 | Dec 5, 2016 | |
| Suse | — | suse-upgrade-apache2suse-upgrade-apache2-develsuse-upgrade-apache2-docsuse-upgrade-apache2-eventsuse-upgrade-apache2-example-pagessuse-upgrade-apache2-preforksuse-upgrade-apache2-utilssuse-upgrade-apache2-worker | Jan 20, 2017 | Dec 5, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub