Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2024-27316: Apache HTTP Server may run out of memory with HTTP/2
CVE-2024-27316 · published 2 years ago
Summary
The Apache web server used on many Linux systems can use all of its memory when it receives a very large or endless series of HTTP/2 request headers. This can cause the server to become slow or stop working, affecting website availability. Update Apache to the latest version or apply the provided patches to limit header processing and prevent the memory overload.
What to do
- Update canonical apache2 to version 2.4.18-2ubuntu3.17+esm12.
- Update canonical apache2 to version 2.4.29-1ubuntu4.27+esm2.
- Update canonical apache2 to version 2.4.41-4ubuntu3.17.
- Update canonical apache2 to version 2.4.52-1ubuntu4.9.
- Update canonical apache2 to version 2.4.58-1ubuntu8.1.
- Update debian apache2 to version 2.4.59-1~deb12u1.
- Update debian apache2 to version 2.4.59-1.
- Update apache http_server to version 2.4.59 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | canonical | apache2 |
< 2.4.18-2ubuntu3.17+esm12 Fix: upgrade to 2.4.18-2ubuntu3.17+esm12
|
| Ubuntu:Pro:18.04:LTS | canonical | apache2 |
< 2.4.29-1ubuntu4.27+esm2 Fix: upgrade to 2.4.29-1ubuntu4.27+esm2
|
| Ubuntu:20.04:LTS | canonical | apache2 |
< 2.4.41-4ubuntu3.17 Fix: upgrade to 2.4.41-4ubuntu3.17
|
| Ubuntu:22.04:LTS | canonical | apache2 |
< 2.4.52-1ubuntu4.9 Fix: upgrade to 2.4.52-1ubuntu4.9
|
| Ubuntu:24.04:LTS | canonical | apache2 |
< 2.4.58-1ubuntu8.1 Fix: upgrade to 2.4.58-1ubuntu8.1
|
| Debian:12 | debian | apache2 |
< 2.4.59-1~deb12u1 Fix: upgrade to 2.4.59-1~deb12u1
|
| Debian:13 | debian | apache2 |
< 2.4.59-1 Fix: upgrade to 2.4.59-1
|
| – | apache | http_server |
>= 2.4.17, < 2.4.59 cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
38 39 40 cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
| – | netapp | ontap |
9 cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:* |
Original advisory text
Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
References
- https://ubuntu.com/security/CVE-2024-27316 Third Party Advisory
- https://kb.cert.org/vuls/id/421644 Third Party Advisory
- https://ubuntu.com/security/notices/USN-6729-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-27316 Third Party Advisory
- https://ubuntu.com/security/notices/USN-6729-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-6729-3 Vendor Advisory
- http://seclists.org/fulldisclosure/2024/Jul/18 URL
- https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html URL
- https://support.apple.com/kb/HT214119 URL
- https://www.kb.cert.org/vuls/id/421644 URL
- https://www.openwall.com/lists/oss-security/2024/04/03/16 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27316... Vendor Advisory
- https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-27316 Vendor Advisory
- https://security.netapp.com/advisory/ntap-20240415-0013/ Vendor Advisory
- http://www.openwall.com/lists/oss-security/2024/04/04/4 URL
- https://lists.fedoraproject.org/archives/list/[email protected]... URL
- https://lists.fedoraproject.org/archives/list/[email protected]... URL
- https://security-tracker.debian.org/tracker/CVE-2024-27316 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published4 Apr 2024
Updated4 Nov 2026
First seen3 Jun 2026
Sources
UBUNTU-CVE-2024-27316 · OSV
CVE-2024-27316 · NVD
DEBIAN-CVE-2024-27316 · OSV
CVE-2024-27316 · OSV
Track software like this
Free during beta