CVE-2016-8740

7.5 highEPSS 79%

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 79% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWEs: CWE-20, CWE-399
Published: 2016-12-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:http_server

References

http://packetstormsecurity.com/files/140023/Apache-HTTPD-Web-Server-2.4.23-Memory-Exhaustion.html
http://rhn.redhat.com/errata/RHSA-2017-1415.html
http://www.securityfocus.com/bid/94650
http://www.securitytracker.com/id/1037388
https://access.redhat.com/errata/RHSA-2017:1161

Check your stack JSON