CVE-2020-9490: apache http_server

Modified

AliasesALPINE-CVE-2020-9490RHSA-2020:3714RHSA-2020:3726+4 more

Published 07-08-2020Last modified 04-08-2024

Vulnerability summary

CVE-2020-9490 is a high (CVSS 7.5) vulnerability in apache http_server. EPSS estimates a 88.84% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 89% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

88.84%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 8

DSA-4757-1 MGASA-2020-0327 OPENSUSE-SU-2020:1285-1 OPENSUSE-SU-2020:1293-1 OPENSUSE-SU-2020:1792-1 SUSE-SU-2020:2311-1+4 more

Timeline

07-08-2020
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.17.5v2.05.0

EPSS trend

Probability

88.84%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 88.84% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-444Inconsistent Interpretation of HTTP RequestsThe product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat44 products

enterprise_linux8.0
enterprise_linux_eus8.1 | 8.2 | 8.4 | 8.6
enterprise_linux_for_ibm_z_systems8.0
enterprise_linux_for_ibm_z_systems_eus8.1 | 8.2 | 8.4 | 8.6
enterprise_linux_for_power_little_endian8.0

enterprise_linux_for_power_little_endian_eus8.1 | 8.2 | 8.4 | 8.6
enterprise_linux_server_aus8.2 | 8.4 | 8.6
enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions8.1 | 8.2 | 8.4 | 8.6
enterprise_linux_server_tus8.2 | 8.4 | 8.6
enterprise_linux_server_update_services_for_sap_solutions8.1 | 8.2 | 8.4 | 8.6
openstack16.1
openstack_for_ibm_power16.1
software_collections1.0
httpd< 0:2.4.37-21.module+el8.2.0+5008+cca404a3 | < 0:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
httpd-debuginfo< 0:2.4.37-21.module+el8.2.0+5008+cca404a3 | < 0:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
httpd-debugsource< 0:2.4.37-21.module+el8.2.0+5008+cca404a3 | < 0:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
httpd-devel< 0:2.4.37-21.module+el8.2.0+5008+cca404a3 | < 0:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
httpd-filesystem< 0:2.4.37-21.module+el8.2.0+5008+cca404a3 | < 0:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
httpd-manual< 0:2.4.37-21.module+el8.2.0+5008+cca404a3 | < 0:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
httpd-tools< 0:2.4.37-21.module+el8.2.0+5008+cca404a3 | < 0:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
httpd-tools-debuginfo< 0:2.4.37-21.module+el8.2.0+5008+cca404a3 | < 0:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
httpd24-httpd< 0:2.4.34-18.el6.1 | < 0:2.4.34-18.el7.1
httpd24-httpd-debuginfo< 0:2.4.34-18.el6.1 | < 0:2.4.34-18.el7.1
httpd24-httpd-devel< 0:2.4.34-18.el6.1 | < 0:2.4.34-18.el7.1
httpd24-httpd-manual< 0:2.4.34-18.el6.1 | < 0:2.4.34-18.el7.1
httpd24-httpd-tools< 0:2.4.34-18.el6.1 | < 0:2.4.34-18.el7.1
httpd24-mod_ldap< 0:2.4.34-18.el6.1 | < 0:2.4.34-18.el7.1
httpd24-mod_proxy_html< 1:2.4.34-18.el6.1 | < 1:2.4.34-18.el7.1
httpd24-mod_session< 0:2.4.34-18.el6.1 | < 0:2.4.34-18.el7.1
httpd24-mod_ssl< 1:2.4.34-18.el6.1 | < 1:2.4.34-18.el7.1
mod_http2< 0:1.11.3-3.module+el8.2.0+7758+84b4ca3e.1 | < 0:1.11.3-3.module+el8.1.0+7763+babdfe5b.1 | < 0:1.11.3-3.module+el8.0.0+7808+f6c0e84d.1
mod_http2-debuginfo< 0:1.11.3-3.module+el8.2.0+7758+84b4ca3e.1 | < 0:1.11.3-3.module+el8.1.0+7763+babdfe5b.1 | < 0:1.11.3-3.module+el8.0.0+7808+f6c0e84d.1
mod_http2-debugsource< 0:1.11.3-3.module+el8.2.0+7758+84b4ca3e.1 | < 0:1.11.3-3.module+el8.1.0+7763+babdfe5b.1 | < 0:1.11.3-3.module+el8.0.0+7808+f6c0e84d.1
mod_ldap< 0:2.4.37-21.module+el8.2.0+5008+cca404a3 | < 0:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
mod_ldap-debuginfo< 0:2.4.37-21.module+el8.2.0+5008+cca404a3 | < 0:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
mod_md< 1:2.0.8-7.module+el8.2.0+5531+7e4d69a2 | < 0:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
mod_md-debuginfo< 1:2.0.8-7.module+el8.2.0+5531+7e4d69a2 | < 0:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
mod_md-debugsource< 1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
mod_proxy_html< 1:2.4.37-21.module+el8.2.0+5008+cca404a3 | < 1:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 1:2.4.37-12.module+el8.0.0+4096+eb40e6da
mod_proxy_html-debuginfo< 1:2.4.37-21.module+el8.2.0+5008+cca404a3 | < 1:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 1:2.4.37-12.module+el8.0.0+4096+eb40e6da
mod_session< 0:2.4.37-21.module+el8.2.0+5008+cca404a3 | < 0:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
mod_session-debuginfo< 0:2.4.37-21.module+el8.2.0+5008+cca404a3 | < 0:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
mod_ssl< 1:2.4.37-21.module+el8.2.0+5008+cca404a3 | < 1:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 1:2.4.37-12.module+el8.0.0+4096+eb40e6da
mod_ssl-debuginfo< 1:2.4.37-21.module+el8.2.0+5008+cca404a3 | < 1:2.4.37-16.module+el8.1.0+4134+e6bad0ed | < 1:2.4.37-12.module+el8.0.0+4096+eb40e6da

Show all 44

Oracle7 products

communications_element_manager≥ 8.2.0, ≤ 8.2.2
communications_session_report_manager≥ 8.2.0, ≤ 8.2.2
communications_session_route_manager≥ 8.2.0, ≤ 8.2.2
enterprise_manager_ops_center12.4.0.0
hyperion_infrastructure_technology11.1.2.4

Show all 7

Debian2 products

apache2< 2.4.46-1
debian_linuxEOL10.0

Alpine1 product

apache2< 2.4.46-r0

Apache1 product

http_server≥ 2.4.20, < 2.4.46

Canonical1 product

ubuntu_linuxEOL16.04 | 18.04 | 20.04

Fedoraproject1 product

fedoraEOL31 | 32

Opensuse1 product

leapEOL15.1 | 15.2

Ubuntu1 product

apache2< 2.4.29-1ubuntu4.14 | < 2.4.41-4ubuntu3.1

9 vendors · 59 products

References

47 links

httpd.apache.org/security/vulnerabilities_24.htmlX Refsource MISCARTICLEREPORTVendor Advisory
security.gentoo.org/glsa/202008-04Vendor AdvisoryX Refsource GENTOOThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
usn.ubuntu.com/4458-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.opensuse.org/opensuse-security-announce/2020-08/msg00068.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-08/msg00071.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory

Show all 47 references

www.debian.org/security/2020/dsa-4757Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.oracle.com/security-alerts/cpuoct2020.htmlX Refsource MISCPatchThird Party Advisory
security.netapp.com/advisory/ntap-20200814-0005/X Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-10/msg00081.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.oracle.com/security-alerts/cpujan2021.htmlX Refsource MISCPatchThird Party Advisory
packetstormsecurity.com/files/160392/Apache-2.4.43-mod_http2-Memory-Corruption.htmlX Refsource MISCThird Party AdvisoryVDB Entry
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
security.alpinelinux.org/vuln/CVE-2020-9490Advisory
access.redhat.com/errata/RHSA-2020:3714Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1866560REPORT
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3714.jsonAdvisory
access.redhat.com/security/cve/CVE-2020-9490REPORT
www.cve.org/CVERecord?id=CVE-2020-9490AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2020-9490AdvisoryOval
access.redhat.com/errata/RHSA-2020:3726Advisory
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3726.jsonAdvisory
access.redhat.com/errata/RHSA-2020:3733Advisory
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3733.jsonAdvisory
access.redhat.com/errata/RHSA-2020:3734Advisory
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3734.jsonAdvisory
ubuntu.com/security/CVE-2020-9490REPORT
www.openwall.com/lists/oss-security/2020/08/07/4REPORT
ubuntu.com/security/notices/USN-4458-1Advisory
security-tracker.debian.org/tracker/CVE-2020-9490Advisory