CVE-2017-9788: apache software foundation apache http server Improper Input Validation
Vulnerability summary
CVE-2017-9788 is a critical (CVSS 9.1) Improper Input Validation vulnerability in apache software foundation apache http server. EPSS estimates a 56.77% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities.
Severe, CVSS 9.1 (NVD); no exploitation reported by the 5 checked sources; EPSS 57% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 14 · Related 2Timeline
- 13-07-2017PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
56.77%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
No change 0.00 pp
From 56.77% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse11 products
- apache2&distro=SUSE Linux Enterprise Server 11 SP4< 2.2.34-70.5.1
- apache2&distro=SUSE Linux Enterprise Server 12 SP2< 2.4.23-29.3.2
- apache2&distro=SUSE Linux Enterprise Server 12 SP3< 2.4.23-29.3.2
- apache2&distro=SUSE Linux Enterprise Server for Raspberry Pi 12 SP2< 2.4.23-29.3.2
- apache2&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4< 2.2.34-70.5.1
Redhat9 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_aus7.2 | 7.3 | 7.4 | 7.6
- enterprise_linux_server_eus6.7 | 7.2 | 7.3 | 7.4 | 7.5 | 7.6
- enterprise_linux_server_tus7.2 | 7.3 | 7.4 | 7.6
Debian2 products
- apache2< 2.4.27-1 | < 2.4.10-10+deb8u10 | < 2.4.25-3+deb9u2 | < 2.2.22-13+deb7u10
- debian_linuxEOL8.0 | 9.0
Netapp2 products
Apache1 product
- http_server≤ 2.2.33 | ≥ 2.4.0, ≤ 2.4.26
Apache software foundation1 product
- apache http server2.2.0 to 2.2.33 | 2.4.1 to 2.4.26
Apple1 product
- mac_os_x< 10.13.1
Oracle1 product
Ubuntu1 product
- apache2< 2.4.7-1ubuntu4.17 | < 2.4.18-2ubuntu3.4
9 vendors · 29 products
References
60 links- support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_usX Refsource CONFIRMThird Party Advisory
Show all 60 references
- www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlX Refsource CONFIRMPatchThird Party Advisory
- www.tenable.com/security/tns-2019-09X Refsource CONFIRM
- bugzilla.suse.com/951692REPORT