KLA10907 Denial of service vulnerability in Apache HTTP Server

An unspecified vulnerability was found in Apache HTTP Server 2.4.17 through 2.4.23. By exploiting this vulnerability malicious users can cause denial of service. This vulnerability can be exploited remotely via crafted continuation frames in a HTTP/2 request.

Technical details

Vulnerability occurs in mod_http2 module, when the Protocols configuration (including h2/h2c) does not confine length of request header. Because of that a specially crafted request can allocate memory on the sever until limit is reached.

Original advisories

Apache httpd 2.4 vulnerabilities

Exploitation

Public exploits exist for this vulnerability.

Related products

Apache-HTTP-Server

CVE list

CVE-2016-8740 warning

Solution

For a 2.4.23 version a patch is supplied. This will be included in the next release.

Security Advisory – Apache Software Foundation

Impacts

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• Apache HTTP Server from 2.4.17 to 2.4.23