cbcvebase.
CVE-2016-8740
published 2016-12-05

CVE-2016-8740: The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header…

high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EXPLOIT
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.

Affected

12 ranges
VendorProductVersion rangeFixed in
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apachehttp_server
apache_software_foundationapache_http_server
applemacos_high_sierra
applemacos_high_sierra_10.13.1_security_update_2017-001_sierra_and_security_update_20
applemacos_sierra_10.12.4_security_update_2017-001_el_capitan_and_security_update_201
debianapache2< apache2 2.4.25-1 (bookworm)apache2 2.4.25-1 (bookworm)

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH