Lucene search

K

ApacheCVELIST:CVE-2024-27316

HistoryApr 04, 2024 - 7:21 p.m.

CVE-2024-27316 Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

2024-04-0419:21:41

CWE-770

apache

www.cve.org

8

cve-2024-27316

apache http server

denial of service

memory exhaustion

http/2

nghttp2

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

47.6%

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache HTTP Server",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.4.58",
        "status": "affected",
        "version": "2.4.17",
        "versionType": "semver"
      }
    ]
  }
]

References

seclists.org/fulldisclosure/2024/Jul/18

www.openwall.com/lists/oss-security/2024/04/04/4

httpd.apache.org/security/vulnerabilities_24.html

support.apple.com/kb/HT214119

www.openwall.com/lists/oss-security/2024/04/03/16

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

47.6%

Related for CVELIST:CVE-2024-27316