7.5

CVE-2024-27316

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ HTTP Server Version >= 2.4.17 < 2.4.59
Fedoraproject ≫ Fedora Version38
Fedoraproject ≫ Fedora Version39
Fedoraproject ≫ Fedora Version40
Netapp ≫ Ontap Version9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 91.33% 0.998
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

https://httpd.apache.org/security/vulnerabilities_24.html
Product
Release Notes
https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html
http://seclists.org/fulldisclosure/2024/Jul/18
https://support.apple.com/kb/HT214119
https://www.kb.cert.org/vuls/id/421644
https://security.netapp.com/advisory/ntap-20240415-0013/
http://www.openwall.com/lists/oss-security/2024/04/04/4
Mailing List
https://www.openwall.com/lists/oss-security/2024/04/03/16
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIUBKSCJGPJ6M2U63V6BKFDF725ODLG7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FO73U3SLBYFGIW2YKXOK7RI4D6DJSZ2B/