CVE-2016-2161: apache software foundation apache http server Use of Out-of-range Pointer Offset
Vulnerability summary
CVE-2016-2161 is a high (CVSS 7.5) Use of Out-of-range Pointer Offset vulnerability in apache software foundation apache http server. EPSS estimates a 20.95% chance of exploitation in the next 30 days, higher than 97.5% of scored vulnerabilities.
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 21% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 10 · Related 4Timeline
- 27-07-2017PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
20.95%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 20.95% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-823Use of Out-of-range Pointer OffsetThe product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Apache1 product
- http_server2.4.0 | 2.4.1 | 2.4.2 | 2.4.3 | 2.4.6 | 2.4.7 | 2.4.8 | 2.4.9 | 2.4.10 | 2.4.12 | 2.4.14 | 2.4.16 | 2.4.19 | 2.4.20 | 2.4.21 | 2.4.22 | 2.4.23
Apache software foundation1 product
- apache http server2.4.0 to 2.4.23
Debian1 product
- apache2< 2.4.25-1
Ubuntu1 product
- apache2< 2.4.7-1ubuntu4.15 | < 2.4.18-2ubuntu3.2
4 vendors · 4 products
References
33 links- support.apple.com/HT208221X Refsource CONFIRM
- www.tenable.com/security/tns-2017-04X Refsource CONFIRM
- h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_usX Refsource CONFIRMThird Party Advisory
Show all 33 references
- security.netapp.com/advisory/ntap-20180423-0001/X Refsource CONFIRM