Description
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server | Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.4.27-6 | — |
| Debian 13 | apache2 | 2.4.27-6 | — |
| Debian 12 | apache2 | 2.4.27-6 | — |
| Debian 9 | apache2 | 2.4.25-3+deb9u3 | DSA-3980-1 |
| Debian 8 | apache2 | 2.4.10-10+deb8u11 | DSA-3980-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | apache2 | 2.2.22-13+deb7u12 | DLA-1102-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | apache2 | 2.4.18-2ubuntu3.5 | USN-3425-1 |
| Ubuntu 14.04 LTS | apache2 | 2.4.7-1ubuntu4.18 | USN-3425-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | httpd +5 | 2.4.6-67.el7_4.5 | RHSA-2017:2882 |
| RHEL 7 | mod_ssl +1 | 1:2.4.6-67.el7_4.5 | RHSA-2017:2882 |
| RHEL 6 | httpd +3 | 2.2.15-60.el6_9.6 | RHSA-2017:2972 |
| RHEL 6 | mod_ssl | 1:2.2.15-60.el6_9.6 | RHSA-2017:2972 |
| RHEL 3 | httpd24 +2 | 1.1-18.el6 | RHSA-2017:3018 |
| RHEL 3 | httpd24-curl +2 | 7.47.1-4.el7 | RHSA-2017:3018 |
| RHEL 3 | httpd24-httpd +5 | 2.4.27-8.el6 | RHSA-2017:3018 |
| RHEL 3 | httpd24-mod_auth_kerb | 5.4-33.el7 | RHSA-2017:3018 |
| RHEL 3 | httpd24-mod_ssl +1 | 1:2.4.27-8.el6 | RHSA-2017:3018 |
| RHEL 3 | httpd24-nghttp2 +2 | 1.7.1-6.el7 | RHSA-2017:3018 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7.3 EUS | httpd +5 | 2.4.6-45.el7_3.5 | RHSA-2017:3194 |
| RHEL 7.3 EUS | mod_ssl +1 | 1:2.4.6-45.el7_3.5 | RHSA-2017:3194 |
| RHEL 7.2 EUS | httpd +5 | 2.4.6-40.el7_2.6 | RHSA-2017:3193 |
| RHEL 7.2 EUS | mod_ssl +1 | 1:2.4.6-40.el7_2.6 | RHSA-2017:3193 |
| RHEL 6.7 EUS | httpd +3 | 2.2.15-47.el6_7.5 | RHSA-2017:3195 |
| RHEL 6.7 EUS | mod_ssl | 1:2.2.15-47.el6_7.5 | RHSA-2017:3195 |
| Red Hat JBoss Web Server 2 | httpd +4 | 2.2.26-57.ep6.el6 | RHSA-2017:3113 |
| Red Hat JBoss Web Server 2 | httpd22 +4 | 2.2.26-58.ep6.el7 | RHSA-2017:3113 |
| Red Hat JBoss Web Server 2 | jbcs-httpd24-openssl +4 | 1:1.0.2h-14.jbcs.el6 | RHSA-2017:3113 |
| Red Hat JBoss Web Server 2 | mod_cluster-native | 1.2.13-9.Final_redhat_2.ep6.el6 | RHSA-2017:3113 |
| Red Hat JBoss Web Server 2 | mod_ssl | 1:2.2.26-57.ep6.el6 | RHSA-2017:3113 |
| Red Hat JBoss Web Server 2 | mod_ssl22 | 1:2.2.26-58.ep6.el7 | RHSA-2017:3113 |
| Red Hat JBoss Web Server 2 | tomcat6 +10 | 6.0.41-19_patch_04.ep6.el6 | RHSA-2017:3113 |
| Red Hat JBoss Web Server 2 | tomcat7 +10 | 7.0.54-28_patch_05.ep6.el6 | RHSA-2017:3113 |
| Red Hat JBoss EAP 6 | httpd +4 | 2.2.26-57.ep6.el6 | RHSA-2017:3240 |
| Red Hat JBoss EAP 6 | httpd22 +4 | 2.2.26-58.ep6.el7 | RHSA-2017:3240 |
| Red Hat JBoss EAP 6 | jbcs-httpd24-openssl +4 | 1:1.0.2h-14.jbcs.el6 | RHSA-2017:3240 |
| Red Hat JBoss EAP 6 | mod_cluster-native | 1.2.13-9.Final_redhat_2.ep6.el6 | RHSA-2017:3240 |
| Red Hat JBoss EAP 6 | mod_ssl | 1:2.2.26-57.ep6.el6 | RHSA-2017:3240 |
| Red Hat JBoss EAP 6 | mod_ssl22 | 1:2.2.26-58.ep6.el7 | RHSA-2017:3240 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +7 | 2.4.23-125.jbcs.el6 | RHSA-2017:3477, RHSA-2017:3476 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_bmx | 0.9.6-15.GA.jbcs.el6 | RHSA-2017:3477, RHSA-2017:3476 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_cluster-native | 1.3.8-1.Final_redhat_1.jbcs.el6 | RHSA-2017:3477, RHSA-2017:3476 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.23-125.jbcs.el6 | RHSA-2017:3477, RHSA-2017:3476 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | apache2 | 2.4.23-29.6.1 | SUSE-SU-2017:2542-1 |
| SLES 12 SP2 | apache2 | 2.4.23-29.6.1 | SUSE-SU-2017:2542-1 |
| SLES 12 SP1 | apache2 | 2.4.16-20.13.1 | SUSE-SU-2017:2718-1 |
| SLES 12 | apache2 | 2.4.10-14.28.1 | SUSE-SU-2017:2756-1 |
| SLES 11 SP4 | apache2 | 2.2.34-70.12.1 | SUSE-SU-2017:2907-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP3 | apache2 | 2.2.34-70.12.1 | SUSE-SU-2017:2907-1 |
| SUSE Studio Onsite 1.3 | apache2 | 2.2.34-70.12.1 | SUSE-SU-2017:2907-1 |
| SLES for SAP 12 SP3 | apache2 | 2.4.23-29.6.1 | SUSE-SU-2017:2542-1 |
| SLES for SAP 12 SP2 | apache2 | 2.4.23-29.6.1 | SUSE-SU-2017:2542-1 |
| SLES for SAP 12 SP1 | apache2 | 2.4.16-20.13.1 | SUSE-SU-2017:2718-1 |
| SLES for SAP 11 SP4 | apache2 | 2.2.34-70.12.1 | SUSE-SU-2017:2907-1 |
| SUSE OpenStack Cloud 6 | apache2 | 2.4.16-20.13.1 | SUSE-SU-2017:2718-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | apache2 | 2.2.34-70.12.1 | SUSE-SU-2017:2907-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.49-1.1 | openSUSE-SU-2024:10623-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | apache2 | 2.4.27-r1 | — |
| Alpine v3.23 | apache2 | 2.4.27-r1 | — |
| Alpine v3.22 | apache2 | 2.4.27-r1 | — |
| Alpine v3.21 | apache2 | 2.4.27-r1 | — |
| Alpine v3.20 | apache2 | 2.4.27-r1 | — |
Show 17 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | apache2 | 2.4.27-r1 | — |
| Alpine v3.18 | apache2 | 2.4.27-r1 | — |
| Alpine v3.17 | apache2 | 2.4.27-r1 | — |
| Alpine v3.16 | apache2 | 2.4.27-r1 | — |
| Alpine v3.15 | apache2 | 2.4.27-r1 | — |
| Alpine v3.14 | apache2 | 2.4.27-r1 | — |
| Alpine v3.13 | apache2 | 2.4.27-r1 | — |
| Alpine v3.12 | apache2 | 2.4.27-r1 | — |
| Alpine v3.11 | apache2 | 2.4.27-r1 | — |
| Alpine v3.10 | apache2 | 2.4.27-r1 | — |
| Alpine v3.9 | apache2 | 2.4.27-r1 | — |
| Alpine v3.8 | apache2 | 2.4.27-r1 | — |
| Alpine v3.7 | apache2 | 2.4.27-r1 | — |
| Alpine v3.6 | apache2 | 2.4.27-r1 | — |
| Alpine v3.5 | apache2 | 2.4.27-r1 | — |
| Alpine v3.4 | apache2 | 2.4.27-r1 | — |
| Alpine v3.3 | apache2 | 2.4.27-r1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | httpd +5 | 2.4.6-67.0.1.el7_4.5 | ELSA-2017-2882 |
| Oracle Linux 7 | mod_ssl +1 | 1:2.4.6-67.0.1.el7_4.5 | ELSA-2017-2882 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Apache Optionsbleed Scanner
auxiliary/scanner/http/apache_optionsbleed
Exploit-DB 1
- Apache < 2.2.34 / < 2.4.27 - OPTIONS Memory Leak EDB-42745 · webapps · Sep 18, 2017
GitHub 4 repositories
-
brokensound77/OptionsBleed-POC-Scanner ★ 19 · Sep 27, 2017
OptionsBleed (CVE-2017-9798) PoC / Scanner
-
nitrado/CVE-2017-9798 ★ 3 · Sep 18, 2017
Checks a shared hosting environment for CVE-2017-9798
-
pabloec20/optionsbleed ★ 2 · Sep 20, 2017
CVE-2017-9798
-
l0n3rs/CVE-2017-9798 ★ 0 · Sep 24, 2017
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 20
- RHSA-2017:3113 Red Hat Security Advisory: Red Hat JBoss Web Server security and bug fix update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2017:3240 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.18 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2017:3477 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:3476 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:3195 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:3193 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:3194 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:2972 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:3018 Red Hat Security Advisory: httpd24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:2882 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- USN-3425-1 apache2 vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-3980-1 apache2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1102-1 apache2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2017:2907-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:2718-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:2542-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:2756-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10623-1 apache2-2.4.49-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-1594 IBM Tivoli Network Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 28, 2023
- ELSA-2017-2882 Moderate: httpd security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 11, 2017
References
- RHSA-2017:3113 vendor-advisory
- 100872 vdb-entry
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- RHSA-2017:2882 vendor-advisory
- RHSA-2017:2972 vendor-advisory
- https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch
- https://support.apple.com/HT208331
- 1039387 vdb-entry
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us
- RHSA-2017:3475 vendor-advisory
- https://github.com/hannob/optionsbleed
- https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch
- RHSA-2017:3240 vendor-advisory
- RHSA-2017:3195 vendor-advisory
- RHSA-2017:3018 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- RHSA-2017:3239 vendor-advisory
- RHSA-2017:3476 vendor-advisory
- 105598 vdb-entry
- https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- RHSA-2017:3114 vendor-advisory
- RHSA-2017:3477 vendor-advisory
- http://openwall.com/lists/oss-security/2017/09/18/2
- https://security.netapp.com/advisory/ntap-20180601-0003/
- RHSA-2017:3194 vendor-advisory
- https://security-tracker.debian.org/tracker/CVE-2017-9798
- RHSA-2017:3193 vendor-advisory
- DSA-3980 vendor-advisory
- https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html
- 42745 exploit
- GLSA-201710-32 vendor-advisory
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- https://www.tenable.com/security/tns-2019-09
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- https://github.com/apache/httpd/commit/4cc27823899e070268b906ca677ee838d07cf67a
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [11/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [11/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [11/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list