PT-2016-7559 · Apache+2 · Apache Http Server+2

Jungun Baek · Published 2016-12-04 · Updated 2026-06-08 · CVE-2016-8740

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.17 through 2.4.23

Description The issue is related to the mod http2 module in the Apache HTTP Server, which does not restrict request-header length when the Protocols configuration includes h2 or h2c. This allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request. The HTTP/2 protocol implementation had an incomplete handling of the LimitRequestFields directive, allowing an attacker to inject unlimited request headers into the server, leading to eventual memory exhaustion.

Recommendations For Apache HTTP Server versions 2.4.17 through 2.4.23, consider disabling the mod http2 module until a patch is available to prevent exploitation. Restrict access to the HTTP/2 protocol to minimize the risk of denial of service attacks. Avoid using the LimitRequestFields directive in the affected HTTP/2 configuration until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

RCE

Weakness Enumeration

CWE-399

CWE-20

Related Identifiers

ALT-PU-2017-1655

CVE-2016-8740

OPENSUSE-SU-2024:10623-1

RHSA-2017:1161

RHSA-2017:1413

RHSA-2017:1414

SUSE-SU-2017:0203-1

SUSE-SU-2017_0203-1

Affected Products

Alt Linux

Apache Http Server

Suse

References · 68

• 🔥 https://exploit-db.com/exploits/40909 · Exploit
• 🔥 http://packetstormsecurity.com/files/140023/Apache-HTTPD-Web-Server-2.4.23-Memory-Exhaustion.html · Exploit
• https://github.com/apache/httpd/commit/29c63b786ae028d82405421585e91283c8fa0da3 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:10623-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8740 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1414 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1161 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-8740 · Vendor Advisory
• https://security.gentoo.org/glsa/201701-36 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-8740 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8740 · Security Note
• https://access.redhat.com/errata/RHSA-2017:1413 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2017-1415.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0203-1 · Vendor Advisory
• https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E · Note