VULNERABILITY INTELLIGENCE
CVE-2016-8740
CVSS score7.5 HIGH
EPSS probability79.07%
CISA KEVNot currently listed
Published2016-12-05
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.
Weakness classification
- CWE-20: Improper Input Validation
Primary references
- security@apache.org — Exploit, Third Party Advisory, VDB Entry
- security@apache.org
- security@apache.org — Third Party Advisory, VDB Entry
- security@apache.org — Third Party Advisory, VDB Entry
- security@apache.org
- security@apache.org
- security@apache.org
- security@apache.org — Issue Tracking, Patch, Third Party Advisory
- security@apache.org
- security@apache.org
- security@apache.org
- security@apache.org