Every CVE Search/ Get API key

CVE-2016-8740

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols...

7.5 HighPublic exploitFix available

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

79.1%Up 6.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.

Record
CVE-2016-8740
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-20, CWE-399
Updated
2026-11-02
CVE List No score

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.

Record
CVE-2016-8740
Updated
2026-11-02
EUVDEUVD-2016-9575 No score

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.

Record
EUVD-2016-9575
Updated
2026-11-03
GitHub AdvisoriesGHSA-pfj2-72r3-p693 7.5

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols...

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.

Record
GHSA-pfj2-72r3-p693
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVBELL-CVE-2016-8740 7.5

CVE-2016-8740 does not affect BellSoft software

Record
BELL-CVE-2016-8740
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.

Record
CVE-2016-8740
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2016-8740 7.5

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.

Record
DEBIAN-CVE-2016-8740
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2017:1161 7.5

Red Hat Security Advisory: httpd24-httpd security, bug fix, and enhancement update

Record
RHSA-2017:1161
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2017:1413 7.5

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 7

Record
RHSA-2017:1413
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2017:1414 7.5

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 6

Record
RHSA-2017:1414
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:10623-1 No score

apache2-2.4.49-1.1 on GA media

These are all security issues fixed in the apache2-2.4.49-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10623-1
Updated
2026-11-02
OSVSUSE-SU-2017:0203-1 No score

Security update for apache2

This update for apache2 fixes the following issues:

  • CVE-2016-8740 Server memory can be exhausted and service denied when HTTP/2 is used [bsc#1013648]
Record
SUSE-SU-2017:0203-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Debian:12
 before 2.4.25-1
2.4.25-1
apache2
Debian:13
 before 2.4.25-1
2.4.25-1
apache2
Debian:14
 before 2.4.25-1
2.4.25-1
httpd24-httpd
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el6
0:2.4.25-9.el6
httpd24-httpd-debuginfo
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el6
0:2.4.25-9.el6
httpd24-httpd-devel
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el6
0:2.4.25-9.el6
httpd24-httpd-manual
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el6
0:2.4.25-9.el6
httpd24-httpd-tools
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el6
0:2.4.25-9.el6
httpd24-mod_ldap
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el6
0:2.4.25-9.el6
httpd24-mod_proxy_html
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 1:2.4.25-9.el6
1:2.4.25-9.el6
Show 54 moreShow less
Affected packages
PackageAffectedFixed
httpd24-mod_session
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el6
0:2.4.25-9.el6
httpd24-mod_ssl
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 1:2.4.25-9.el6
1:2.4.25-9.el6
httpd24-httpd
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el7
0:2.4.25-9.el7
httpd24-httpd-debuginfo
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el7
0:2.4.25-9.el7
httpd24-httpd-devel
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el7
0:2.4.25-9.el7
httpd24-httpd-manual
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el7
0:2.4.25-9.el7
httpd24-httpd-tools
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el7
0:2.4.25-9.el7
httpd24-mod_ldap
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el7
0:2.4.25-9.el7
httpd24-mod_proxy_html
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 1:2.4.25-9.el7
1:2.4.25-9.el7
httpd24-mod_session
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el7
0:2.4.25-9.el7
httpd24-mod_ssl
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 1:2.4.25-9.el7
1:2.4.25-9.el7
jbcs-httpd24-httpd
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el7
0:2.4.23-120.jbcs.el7
jbcs-httpd24-httpd-debuginfo
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el7
0:2.4.23-120.jbcs.el7
jbcs-httpd24-httpd-devel
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el7
0:2.4.23-120.jbcs.el7
jbcs-httpd24-httpd-libs
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el7
0:2.4.23-120.jbcs.el7
jbcs-httpd24-httpd-manual
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el7
0:2.4.23-120.jbcs.el7
jbcs-httpd24-httpd-selinux
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el7
0:2.4.23-120.jbcs.el7
jbcs-httpd24-httpd-tools
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el7
0:2.4.23-120.jbcs.el7
jbcs-httpd24-mod_ldap
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el7
0:2.4.23-120.jbcs.el7
jbcs-httpd24-mod_proxy_html
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 1:2.4.23-120.jbcs.el7
1:2.4.23-120.jbcs.el7
jbcs-httpd24-mod_security
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 0:2.9.1-19.GA.jbcs.el7
0:2.9.1-19.GA.jbcs.el7
jbcs-httpd24-mod_security-debuginfo
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 0:2.9.1-19.GA.jbcs.el7
0:2.9.1-19.GA.jbcs.el7
jbcs-httpd24-mod_session
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el7
0:2.4.23-120.jbcs.el7
jbcs-httpd24-mod_ssl
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 1:2.4.23-120.jbcs.el7
1:2.4.23-120.jbcs.el7
jbcs-httpd24-openssl
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 1:1.0.2h-13.jbcs.el7
1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-debuginfo
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 1:1.0.2h-13.jbcs.el7
1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-devel
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 1:1.0.2h-13.jbcs.el7
1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-libs
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 1:1.0.2h-13.jbcs.el7
1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-perl
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 1:1.0.2h-13.jbcs.el7
1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-static
Red Hat:jboss_core_services:1::el7
From an advisory covering 7 CVEs
 before 1:1.0.2h-13.jbcs.el7
1:1.0.2h-13.jbcs.el7
jbcs-httpd24-httpd
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el6
0:2.4.23-120.jbcs.el6
jbcs-httpd24-httpd-debuginfo
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el6
0:2.4.23-120.jbcs.el6
jbcs-httpd24-httpd-devel
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el6
0:2.4.23-120.jbcs.el6
jbcs-httpd24-httpd-libs
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el6
0:2.4.23-120.jbcs.el6
jbcs-httpd24-httpd-manual
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el6
0:2.4.23-120.jbcs.el6
jbcs-httpd24-httpd-selinux
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el6
0:2.4.23-120.jbcs.el6
jbcs-httpd24-httpd-tools
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el6
0:2.4.23-120.jbcs.el6
jbcs-httpd24-mod_ldap
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el6
0:2.4.23-120.jbcs.el6
jbcs-httpd24-mod_proxy_html
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 1:2.4.23-120.jbcs.el6
1:2.4.23-120.jbcs.el6
jbcs-httpd24-mod_security
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 0:2.9.1-19.GA.jbcs.el6
0:2.9.1-19.GA.jbcs.el6
jbcs-httpd24-mod_security-debuginfo
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 0:2.9.1-19.GA.jbcs.el6
0:2.9.1-19.GA.jbcs.el6
jbcs-httpd24-mod_session
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 0:2.4.23-120.jbcs.el6
0:2.4.23-120.jbcs.el6
jbcs-httpd24-mod_ssl
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 1:2.4.23-120.jbcs.el6
1:2.4.23-120.jbcs.el6
jbcs-httpd24-openssl
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 1:1.0.2h-13.jbcs.el6
1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-debuginfo
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 1:1.0.2h-13.jbcs.el6
1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-devel
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 1:1.0.2h-13.jbcs.el6
1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-libs
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 1:1.0.2h-13.jbcs.el6
1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-perl
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 1:1.0.2h-13.jbcs.el6
1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-static
Red Hat:jboss_core_services:1::el6
From an advisory covering 7 CVEs
 before 1:1.0.2h-13.jbcs.el6
1:1.0.2h-13.jbcs.el6
apache2
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
 before 2.4.23-16.3
2.4.23-16.3
apache2
SUSE:Linux Enterprise Software Development Kit 12 SP2
 before 2.4.23-16.3
2.4.23-16.3
apache2
SUSE:Linux Enterprise Server 12 SP2
 before 2.4.23-16.3
2.4.23-16.3
apache2
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 2.4.23-16.3
2.4.23-16.3
apache2
openSUSE:Tumbleweed
From an advisory covering 27 CVEs
 before 2.4.49-1.1
2.4.49-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBApache 2.4.23 mod_http2 - Denial of Service2016-12-12
PoC in GitHublcfpadilha/mac0352-ep42017-10-11
PoC in GitHubjptr218/apachedos2021-08-03

History

History
RecordedChangedSources
affected, exploits, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-8740 is a high vulnerability (CVSS 7.5) in Apache Http Server, published December 5, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 79.1%, the 99th percentile. Fixed in apache2 2.4.25-1.

References

Show 122 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open