Every CVE Search/ Get API key

CVE-2017-7659

A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4...

7.5 HighFix available

A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

53.9%Up 41.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.

Record
CVE-2017-7659
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.

Record
CVE-2017-7659
Updated
2026-11-02
EUVDEUVD-2017-16661 No score

A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.

Record
EUVD-2017-16661
Updated
2026-11-03
GitHub AdvisoriesGHSA-64wg-r59g-c9jm 7.5

A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4...

A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.

Record
GHSA-64wg-r59g-c9jm
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVALPINE-CVE-2017-7659 7.5

A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.

Record
ALPINE-CVE-2017-7659
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2017-7659 7.5

CVE-2017-7659 does not affect BellSoft software

Record
BELL-CVE-2017-7659
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 4 moreShow less
OSV 7.5

A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.

Record
CVE-2017-7659
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-7659 7.5

A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.

Record
DEBIAN-CVE-2017-7659
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2017:2483 7.4

Red Hat Security Advisory: httpd24-httpd security update

Record
RHSA-2017:2483
CVSS 3.0
7.4 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVSUSE-SU-2018:0261-1 No score

Recommended update for apache2

This update for apache2 fixes several issues.

These security issues were fixed:

  • CVE-2017-9789: When under stress (closing many connections) the HTTP/2 handling code would sometimes access memory after it has been freed, resulting in potentially erratic behaviour (bsc#1048575).
  • CVE-2017-7659: A maliciously constructed HTTP/2 request could cause mod_http2 to dereference a NULL pointer and crash the server process (bsc#1045160).

These non-security issues were fixed:

  • Use the full path to a2enmod and a2dismod in the apache-22-24-upgrade script (bsc#1042037)
  • Fall back to 'localhost' as hostname in gensslcert (bsc#1057406)
Record
SUSE-SU-2018:0261-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Alpine:v3.10
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.11
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.12
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.13
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.14
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.15
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.16
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.17
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.18
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.19
 before 2.4.26-r0
2.4.26-r0
Show 40 moreShow less
Affected packages
PackageAffectedFixed
apache2
Alpine:v3.20
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.21
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.22
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.23
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.24
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.3
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.4
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.5
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.6
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.7
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.8
 before 2.4.26-r0
2.4.26-r0
apache2
Alpine:v3.9
 before 2.4.26-r0
2.4.26-r0
apache2
Debian:12
 before 2.4.25-4
2.4.25-4
apache2
Debian:13
 before 2.4.25-4
2.4.25-4
apache2
Debian:14
 before 2.4.25-4
2.4.25-4
httpd24-httpd
Red Hat:rhel_software_collections:2::el6
 before 0:2.4.25-9.el6.1
0:2.4.25-9.el6.1
httpd24-httpd-debuginfo
Red Hat:rhel_software_collections:2::el6
 before 0:2.4.25-9.el6.1
0:2.4.25-9.el6.1
httpd24-httpd-devel
Red Hat:rhel_software_collections:2::el6
 before 0:2.4.25-9.el6.1
0:2.4.25-9.el6.1
httpd24-httpd-manual
Red Hat:rhel_software_collections:2::el6
 before 0:2.4.25-9.el6.1
0:2.4.25-9.el6.1
httpd24-httpd-tools
Red Hat:rhel_software_collections:2::el6
 before 0:2.4.25-9.el6.1
0:2.4.25-9.el6.1
httpd24-mod_ldap
Red Hat:rhel_software_collections:2::el6
 before 0:2.4.25-9.el6.1
0:2.4.25-9.el6.1
httpd24-mod_proxy_html
Red Hat:rhel_software_collections:2::el6
 before 1:2.4.25-9.el6.1
1:2.4.25-9.el6.1
httpd24-mod_session
Red Hat:rhel_software_collections:2::el6
 before 0:2.4.25-9.el6.1
0:2.4.25-9.el6.1
httpd24-mod_ssl
Red Hat:rhel_software_collections:2::el6
 before 1:2.4.25-9.el6.1
1:2.4.25-9.el6.1
httpd24-httpd
Red Hat:rhel_software_collections:2::el7
 before 0:2.4.25-9.el7.1
0:2.4.25-9.el7.1
httpd24-httpd-debuginfo
Red Hat:rhel_software_collections:2::el7
 before 0:2.4.25-9.el7.1
0:2.4.25-9.el7.1
httpd24-httpd-devel
Red Hat:rhel_software_collections:2::el7
 before 0:2.4.25-9.el7.1
0:2.4.25-9.el7.1
httpd24-httpd-manual
Red Hat:rhel_software_collections:2::el7
 before 0:2.4.25-9.el7.1
0:2.4.25-9.el7.1
httpd24-httpd-tools
Red Hat:rhel_software_collections:2::el7
 before 0:2.4.25-9.el7.1
0:2.4.25-9.el7.1
httpd24-mod_ldap
Red Hat:rhel_software_collections:2::el7
 before 0:2.4.25-9.el7.1
0:2.4.25-9.el7.1
httpd24-mod_proxy_html
Red Hat:rhel_software_collections:2::el7
 before 1:2.4.25-9.el7.1
1:2.4.25-9.el7.1
httpd24-mod_session
Red Hat:rhel_software_collections:2::el7
 before 0:2.4.25-9.el7.1
0:2.4.25-9.el7.1
httpd24-mod_ssl
Red Hat:rhel_software_collections:2::el7
 before 1:2.4.25-9.el7.1
1:2.4.25-9.el7.1
apache2
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
 before 2.4.23-29.13.1
2.4.23-29.13.1
apache2
SUSE:Linux Enterprise Software Development Kit 12 SP2
 before 2.4.23-29.13.1
2.4.23-29.13.1
apache2
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 2.4.23-29.13.1
2.4.23-29.13.1
apache2
SUSE:Linux Enterprise Server 12 SP2
 before 2.4.23-29.13.1
2.4.23-29.13.1
apache2
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 2.4.23-29.13.1
2.4.23-29.13.1
apache2
SUSE:Linux Enterprise Server 12 SP3
 before 2.4.23-29.13.1
2.4.23-29.13.1
apache2
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 2.4.23-29.13.1
2.4.23-29.13.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-7659 is a high vulnerability (CVSS 7.5) in Apache Http Server, published July 26, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 53.9%, the 99th percentile. Fixed in apache2 2.4.26-r0.

References

Show 72 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open