CVE-2024-27316CWE-770

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

High · published April 4, 2024

Patch now

High probability of exploitation

CVSS calls it high at 7.5. It sits in the 99.8th percentile for exploit probability.

CVSS v3.1
7.5
EPSS
91%
Percentile
99.8
In the wild
Unconfirmed
What it is

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.91327 · 99.8th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2024-04-04T19:21Z
EPSS history
Timeline
  • 04 APR 19:21Z
    Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames
    cvelistv5