CVE-2020-11993

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were…

published August 7, 2020

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.1th percentile for exploit probability.

CVSS
—
EPSS
56%
Percentile
99.1
In the wild
Unconfirmed
What it is

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.56448 · 99.1th percentile
Published
2020-08-07T15:32Z
EPSS history
Timeline
  • 07 AUG 15:32Z
    Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were…
    cvelistv5