CVE-2024-27316

🗓️ 04 Apr 2024 19:21:41Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 2722 Views🌐 WEB

HTTP/2 headers limit memory exhaustion

Reporter	Title	Published	Views	Family All 311
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to glibc, Golang Go , Apache HTTP, IBM GSKit-Crypto and GnuTLS packages/liberaries .	22 May 202409:19	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in httpd (CVE-2024-27316) affects Power HMC	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified with the DS8900F and DS8A00 Hardware Management Console (HMC)	27 May 202523:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in http-server affect Cloud Pak System	29 Oct 202410:37	–	ibm
IBM Security Bulletins	Security Bulletin: TSSC/IMC is vulnerable to a denial of service on Apache HTTP Server	15 Nov 202421:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which are vulnerable to CVEs.	3 Nov 202509:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM HTTP Server (powered by Apache) for IBM i is vulnerable to a denial of service attack using HTTP/2 protocol. [CVE-2024-27316]	25 Jun 202423:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.7.3 addresses multiple security vulnerabilities	26 Mar 202504:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Aspera Console has addressed a denial of service vulnerability (CVE-2024-27316)	29 May 202421:22	–	ibm
GithubExploit	Exploit for Allocation of Resources Without Limits or Throttling in Apache Http_Server	17 Apr 202420:08	–	githubexploit

NVD

Vulners

Vulnrichment

Node

apache http_serverRange2.4.17–2.4.59

Node

fedoraproject fedoraMatch38

fedoraproject fedoraMatch39

fedoraproject fedoraMatch40

Node

netapp ontapMatch9

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache HTTP Server",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.4.58",
        "status": "affected",
        "version": "2.4.17",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2024/04/04/4
httpd	www.httpd.apache.org/security/vulnerabilities_24.html
support	www.support.apple.com/kb/HT214119
openwall	www.openwall.com/lists/oss-security/2024/04/03/16
seclists	www.seclists.org/fulldisclosure/2024/Jul/18
kb	www.kb.cert.org/vuls/id/421644
lists	www.lists.debian.org/debian-lts-announce/2024/05/msg00013.html
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/FO73U3SLBYFGIW2YKXOK7RI4D6DJSZ2B/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/MIUBKSCJGPJ6M2U63V6BKFDF725ODLG7/
security	www.security.netapp.com/advisory/ntap-20240415-0013/

Parameter	Position	Path	Description	CWE
:method	header	localhost:3392/	CVE-2024-27316: HTTP/2 header flood can exhaust memory leading to 413 and potential DoS (CWE-770).	CWE-770
:scheme	header	localhost:3392/	CVE-2024-27316: HTTP/2 header flood can exhaust memory leading to 413 and potential DoS (CWE-770).	CWE-770
:path	header	localhost:3392/	CVE-2024-27316: HTTP/2 header flood can exhaust memory leading to 413 and potential DoS (CWE-770).	CWE-770
Header-Continuation-Overflow	header	localhost:3392/	CVE-2024-27316: HTTP/2 header flood can exhaust memory leading to 413 and potential DoS (CWE-770).	CWE-770
:method	header	localhost:3393/	CVE-2024-27316: HTTP/2 header flood can exhaust memory leading to 413 and potential DoS (CWE-770).	CWE-770
:scheme	header	localhost:3393/	CVE-2024-27316: HTTP/2 header flood can exhaust memory leading to 413 and potential DoS (CWE-770).	CWE-770
:path	header	localhost:3393/	CVE-2024-27316: HTTP/2 header flood can exhaust memory leading to 413 and potential DoS (CWE-770).	CWE-770
Header-Continuation-Overflow	header	localhost:3393/	CVE-2024-27316: HTTP/2 header flood can exhaust memory leading to 413 and potential DoS (CWE-770).	CWE-770

17 Jun 2026 07:19Current

7.2High risk

Vulners AI Score7.2

CVSS 3.17.5

EPSS0.91327

SSVC

CWE-770