CVE-2017-9798: apache software foundation apache http server Use After Free

Modified

AliasesALPINE-CVE-2017-9798MGASA-2018-0009SUSE-SU-2017:2542-1+8 more

Published 18-09-2017Last modified 04-11-2025

Vulnerability summary

CVE-2017-9798 is a high (CVSS 7.5) Use After Free vulnerability in apache software foundation apache http server. EPSS estimates a 95.00% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 5 public exploits are recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (Metasploit, 18-09-2017)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

95.00%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits5github, reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 12 · Related 3

MGASA-2018-0007 OPENSUSE-SU-2024:10623-1 RHSA-2017:2972 RHSA-2017:3113 RHSA-2017:3193 RHSA-2017:3194+6 more

Timeline

18-09-2017
PublishedVulnerability first disclosed.
04-11-2025
Last modifiedVulnerability information updated.

Description

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.

CVSS metrics

7 scores · 5 sources · 3 versions

v3.17.5v3.05.9v2.05.0

EPSS trend

Probability

95.00%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 95.00% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

5 found

githubUnverified
Optionsbleed
Maturity: poc
referenceUnverified
Exploit Reference (blog.fuzzing-project.org)
Maturity: unknown
referenceUnverified
Exploit Reference (blog.fuzzing-project.org)
Maturity: unknown

Show all 5 exploits

exploit-databaselinuxUnverified
Apache < 2.2.34 / < 2.4.27 - OPTIONS Memory Leak
Maturity: poc
MetasploitremoteUnverified
Apache Optionsbleed Scanner
auxiliary/scanner/http/apache_optionsbleed
Maturity: poc

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat31 products

httpd< 0:2.4.6-67.el7_4.5
httpd-debuginfo< 0:2.4.6-67.el7_4.5
httpd-devel< 0:2.4.6-67.el7_4.5
httpd-manual< 0:2.4.6-67.el7_4.5
httpd-tools< 0:2.4.6-67.el7_4.5

Show all 31

Suse10 products

apache2&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 2.4.16-20.13.1
apache2&distro=SUSE Linux Enterprise Server 12 SP2< 2.4.23-29.6.1
apache2&distro=SUSE Linux Enterprise Server 12 SP3< 2.4.23-29.6.1
apache2&distro=SUSE Linux Enterprise Server for Raspberry Pi 12 SP2< 2.4.23-29.6.1
apache2&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1< 2.4.16-20.13.1

Show all 10

Debian2 products

apache2< 2.4.27-6 | < 2.4.10-10+deb8u11 | < 2.4.25-3+deb9u3 | < 2.2.22-13+deb7u12
debian_linuxEOL7.0 | 8.0 | 9.0

Alpine1 product

apache2< 2.4.27-r1

Apache1 product

http_server≤ 2.2.34 | 2.4.0 | 2.4.1 | 2.4.2 | 2.4.3 | 2.4.4 | 2.4.6 | 2.4.7 | 2.4.9 | 2.4.10 | 2.4.12 | 2.4.16 | 2.4.17 | 2.4.18 | 2.4.20 | 2.4.23 | 2.4.25 | 2.4.26 | 2.4.27

Apache software foundation1 product

apache http serverApache HTTP Server through 2.2.34 and 2.4.x through 2.4.27

Mageia1 product

apache< 2.4.27-1.1.mga6

Ubuntu1 product

apache2< 2.4.7-1ubuntu4.18 | < 2.4.18-2ubuntu3.5

8 vendors · 48 products

References

84 links

access.redhat.com/errata/RHSA-2017:3113Vendor AdvisoryX Refsource REDHATThird Party Advisory
www.securityfocus.com/bid/100872VDB EntryX Refsource BIDThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlX Refsource CONFIRMPatchThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlX Refsource CONFIRMPatchThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlX Refsource CONFIRMPatchThird Party Advisory
access.redhat.com/errata/RHSA-2017:2882Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
access.redhat.com/errata/RHSA-2017:2972Vendor AdvisoryX Refsource REDHATThird Party Advisory
blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patchX Refsource MISCExploitPatchTechnical DescriptionThird Party Advisory
support.apple.com/HT208331X Refsource CONFIRMThird Party Advisory
www.securitytracker.com/id/1039387VDB EntryX Refsource SECTRACKThird Party Advisory

Show all 84 references

support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_usX Refsource CONFIRMThird Party Advisory
access.redhat.com/errata/RHSA-2017:3475Vendor AdvisoryX Refsource REDHATThird Party Advisory
github.com/hannob/optionsbleedX Refsource MISCExploitThird Party AdvisoryREPORT
svn.apache.org/viewvc/…X Refsource MISCVendor Advisory
access.redhat.com/errata/RHSA-2017:3240Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2017:3195Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2017:3018Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlX Refsource CONFIRMPatchThird Party Advisory
access.redhat.com/errata/RHSA-2017:3239Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2017:3476Vendor AdvisoryX Refsource REDHATThird Party Advisory
www.securityfocus.com/bid/105598VDB EntryX Refsource BIDThird Party Advisory
httpd.apache.org/security/vulnerabilities_24.htmlX Refsource CONFIRMVendor Advisory
www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlX Refsource CONFIRMPatchThird Party Advisory
access.redhat.com/errata/RHSA-2017:3114Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2017:3477Vendor AdvisoryX Refsource REDHATThird Party Advisory
openwall.com/lists/oss-security/2017/09/18/2X Refsource MISCMailing ListVDB Entry
security.netapp.com/advisory/ntap-20180601-0003/X Refsource CONFIRMThird Party Advisory
access.redhat.com/errata/RHSA-2017:3194Vendor AdvisoryX Refsource REDHATThird Party Advisory
security-tracker.debian.org/tracker/CVE-2017-9798X Refsource MISCThird Party AdvisoryAdvisory
access.redhat.com/errata/RHSA-2017:3193Vendor AdvisoryX Refsource REDHATThird Party Advisory
www.debian.org/security/2017/dsa-3980Vendor AdvisoryX Refsource DEBIANThird Party Advisory
blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.htmlX Refsource MISCExploitPatchTechnical DescriptionThird Party AdvisoryARTICLEREPORT
www.exploit-db.com/exploits/42745/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
security.gentoo.org/glsa/201710-32Vendor AdvisoryX Refsource GENTOOThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlX Refsource MISCPatchThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
www.tenable.com/security/tns-2019-09X Refsource CONFIRMThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
github.com/apache/httpd/commit/4cc27823899e070268b906ca677ee838d07cf67aX Refsource MISCPatchVendor Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
seclists.org/fulldisclosure/2024/Sep/22
security.alpinelinux.org/vuln/CVE-2017-9798Advisory
advisories.mageia.org/MGASA-2018-0009.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=21741REPORT
usn.ubuntu.com/usn/usn-3425-1/WEB
www.suse.com/support/update/announcement/2017/suse-su-20172542-1/Advisory
bugzilla.suse.com/1058058REPORT
www.suse.com/security/cve/CVE-2017-9798WEB
www.suse.com/support/update/announcement/2017/suse-su-20172718-1/Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1490344REPORT
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2882.jsonAdvisory
access.redhat.com/security/cve/CVE-2017-9798REPORT
www.cve.org/CVERecord?id=CVE-2017-9798AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2017-9798Advisory
access.redhat.com/documentation/…ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1327548REPORT
bugzilla.redhat.com/show_bug.cgi?id=1418395REPORT
bugzilla.redhat.com/show_bug.cgi?id=1428940REPORT
bugzilla.redhat.com/show_bug.cgi?id=1440858REPORT
bugzilla.redhat.com/show_bug.cgi?id=1457316REPORT
bugzilla.redhat.com/show_bug.cgi?id=1480506REPORT
bugzilla.redhat.com/show_bug.cgi?id=1486843REPORT
bugzilla.redhat.com/show_bug.cgi?id=1487164REPORT
bugzilla.redhat.com/show_bug.cgi?id=1488541REPORT
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3018.jsonAdvisory
ubuntu.com/security/CVE-2017-9798REPORT
ubuntu.com/security/notices/USN-3425-1Advisory
ubuntu.com/security/notices/USN-3425-2Advisory