PT-2016-2318 · Apache+1 · Apache Http Server+1

Noam Mazor · Published 2016-04-11 · Updated 2026-06-08 · CVE-2016-1546

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.17 through 2.4.18

Description The issue is related to resource management errors in the Apache HTTP Server. It allows a remote attacker to cause a denial of service by modifying flow-control windows, leading to a stream-processing outage. This is achieved by manipulating the flow control windows on streams, which can block server threads for extended periods, causing starvation of worker threads. Although new connections can still be opened, no streams are processed for these connections.

Recommendations For Apache HTTP Server versions 2.4.17 and 2.4.18, consider disabling the mod http2 module as a temporary workaround to prevent exploitation until a patch is available. Restrict access to HTTP/2 connections to minimize the risk of denial of service attacks.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

ALT-PU-2016-1877

BDU:2016-01707

CVE-2016-1546

RHSA-2017:1161

Affected Products

Alt Linux

Apache Http Server

References · 32

• https://security-tracker.debian.org/tracker/CVE-2016-1546 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1546 · Security Note
• http://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01707 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1546 · Vendor Advisory
• https://security.gentoo.org/glsa/201610-02 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1161 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-1546 · Vendor Advisory
• https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E · Note
• http://securityfocus.com/bid/92331 · Note
• http://svn.apache.org/viewvc?view=revision&revision=1733727 · Note