CVE-2016-8740: apache software foundation apache http server Improper Input Validation
Vulnerability summary
CVE-2016-8740 is a high (CVSS 7.5) Improper Input Validation vulnerability in apache software foundation apache http server. EPSS estimates a 79.07% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 2 public exploits are recorded.
Public exploit (exploit-database, 12-12-2016)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 1Timeline
- 05-12-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
79.07%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
No change 0.00 pp
From 79.07% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Apache 2.4.23 mod_http2 - Denial of Service
Maturity: poc
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-399Resource Management ErrorsWeaknesses in this category are related to improper management of system resources.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse4 products
- apache2&distro=SUSE Linux Enterprise Server 12 SP2< 2.4.23-16.3
- apache2&distro=SUSE Linux Enterprise Server for Raspberry Pi 12 SP2< 2.4.23-16.3
- apache2&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2< 2.4.23-16.3
- apache2&distro=SUSE Linux Enterprise Software Development Kit 12 SP2< 2.4.23-16.3
Apache1 product
- http_server2.4.17 | 2.4.18 | 2.4.19 | 2.4.20 | 2.4.21 | 2.4.22 | 2.4.23
Apache software foundation1 product
- apache http server2.4.17 - 2.4.23
Debian1 product
- apache2< 2.4.25-1
4 vendors · 7 products
References
32 links- support.apple.com/HT208221X Refsource CONFIRM
- github.com/apache/httpd/commit/29c63b786ae028d82405421585e91283c8fa0da3X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
- packetstormsecurity.com/files/140023/Apache-HTTPD-Web-Server-2.4.23-Memory-Exhaustion.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
- www.tenable.com/security/tns-2017-04X Refsource CONFIRM
Show all 32 references
- security.netapp.com/advisory/ntap-20180423-0001/X Refsource CONFIRM
