CVE-2016-1546

The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection…

published July 6, 2016

CVSS
—
EPSS
16%
Percentile
96.9
In the wild
Unconfirmed
What it is

The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service (stream-processing outage) via modified flow-control windows.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.15923 · 96.9th percentile
Published
2016-07-06T14:00Z
EPSS history
Timeline
  • 06 JUL 14:00Z
    The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection…
    cvelistv5