CVE-2016-8743: apache software foundation apache http server
Vulnerability summary
CVE-2016-8743 is a high (CVSS 7.5) vulnerability in apache software foundation apache http server. EPSS estimates a 13.25% chance of exploitation in the next 30 days, higher than 96.3% of scored vulnerabilities.
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 13% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 13 · Related 7Timeline
- 27-07-2017PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NDiffers
EPSS trend
Probability
13.25%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
No change 0.00 pp
From 13.25% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat13 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_eus7.3 | 7.4 | 7.5 | 7.6 | 7.7
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_aus7.3 | 7.4 | 7.6 | 7.7
- enterprise_linux_server_tus7.3 | 7.6 | 7.7
Debian2 products
- apache2< 2.4.25-1 | < 2.2.22-13+deb7u8 | < 2.2.22-13+deb7u11
- debian_linuxEOL8.0 | 9.0
Netapp2 products
Apache1 product
- http_server≥ 2.2.0, ≤ 2.2.31 | ≥ 2.4.1, ≤ 2.4.23
Apache software foundation1 product
- apache http server2.2.0 to 2.2.31, 2.4.1 to 2.4.23
Ubuntu1 product
- apache2< 2.4.7-1ubuntu4.15 | < 2.4.18-2ubuntu3.2
6 vendors · 20 products
References
55 links
- access.redhat.com/errata/RHSA-2017:1721Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03753en_usX Refsource CONFIRMThird Party Advisory
Show all 55 references
- h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_usX Refsource CONFIRMThird Party Advisory
- security.gentoo.org/glsa/201701-36Vendor AdvisoryX Refsource GENTOOPatchThird Party AdvisoryVDB Entry
