Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2024-27316 EUVD-2024-24531GHSA-5qc4-82jh-h385

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

Published Apr 4, 2024 · Updated Nov 4, 2025 · Assigned by apache

Description

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache HTTP Server 2.4.17 – ≤ 2.4.58 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 apache2 2.4.59-1 —
Debian 13 apache2 2.4.59-1 —
Debian 12 apache2 2.4.59-1~deb12u1 DSA-5662-1
Debian 11 apache2 2.4.59-1~deb11u1 DSA-5662-1
Debian 10 apache2 2.4.59-1~deb10u1 DLA-3818-1
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS apache2 2.4.58-1ubuntu8.1 USN-6729-3
Ubuntu 22.04 LTS apache2 2.4.52-1ubuntu4.9 USN-6729-1
Ubuntu 20.04 LTS apache2 2.4.41-4ubuntu3.17 USN-6729-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS apache2 2.4.29-1ubuntu4.27+esm2 USN-6729-2
Ubuntu Pro 16.04 LTS apache2 2.4.18-2ubuntu3.17+esm12 USN-6729-2
ReleasePackageFixed inAdvisory
RHEL 9 mod_http2 1.15.19-5.el9_3.1 RHSA-2024:2564, RHSA-2024:1872
RHEL 8 httpd +6 2.4.37-62.module+el8.9.0+19699+7a7a2044 RHSA-2024:1786
RHEL 8 mod_http2 1.15.7-8.module+el8.9.0+21652+2dd1200b.5 RHSA-2024:1786
RHEL 8 mod_md 1:2.0.8-8.module+el8.9.0+19080+567b90f8 RHSA-2024:1786
RHEL 8 mod_ssl +1 1:2.4.37-62.module+el8.9.0+19699+7a7a2044 RHSA-2024:1786
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.2 EUS mod_http2 1.15.19-4.el9_2.6 RHSA-2024:3402
RHEL 9.0 EUS mod_http2 1.15.19-3.el9_0.6 RHSA-2024:3417
RHEL 8.8 EUS httpd +6 2.4.37-56.module+el8.8.0+19808+379766d6.7 RHSA-2024:2891
RHEL 8.8 EUS mod_http2 1.15.7-8.module+el8.8.0+21773+20528f83.5 RHSA-2024:2891
RHEL 8.8 EUS mod_md 1:2.0.8-8.module+el8.3.0+6814+67d1e611 RHSA-2024:2891
RHEL 8.8 EUS mod_ssl +1 1:2.4.37-56.module+el8.8.0+19808+379766d6.7 RHSA-2024:2891
RHEL 8.6 EUS httpd +6 2.4.37-47.module+el8.6.0+19809+6e655c60.7 RHSA-2024:2907
RHEL 8.6 EUS mod_http2 1.15.7-5.module+el8.6.0+21746+f601aac0.3 RHSA-2024:2907
RHEL 8.6 EUS mod_md 1:2.0.8-8.module+el8.3.0+6814+67d1e611 RHSA-2024:2907
RHEL 8.6 EUS mod_ssl +1 1:2.4.37-47.module+el8.6.0+19809+6e655c60.7 RHSA-2024:2907
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-apache-commons-beanutils 1.11.0-1.redhat_00001.1.el7eap RHSA-2025:16668, RHSA-2025:16667
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-hibernate-validator +1 5.3.6-1.SP1_redhat_00001.1.ep7.el7 RHSA-2025:16668
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-hornetq +3 2.4.11-1.Final_redhat_00001.1.el7eap RHSA-2025:16668, RHSA-2025:16667
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-server-migration +21 1.7.2-19.Final_redhat_00020.1.el7eap RHSA-2025:16667
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-undertow 1.4.18-17.SP15_redhat_00001.1.ep7.el7 RHSA-2025:16668, RHSA-2025:16667
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly +1 7.1.12-2.GA_redhat_00002.1.ep7.el7 RHSA-2025:16668, RHSA-2025:16667
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-javadocs +2 7.3.15-5.GA_redhat_00003.1.el7eap RHSA-2025:16667
Red Hat JBoss EAP 8 eap8-hibernate +2 6.2.26-1.Final_redhat_00001.1.el8eap RHSA-2024:4390
Red Hat JBoss EAP 8 eap8-jboss-remoting 5.0.29-1.Final_redhat_00001.1.el8eap RHSA-2024:4390
Red Hat JBoss EAP 8 eap8-jboss-xnio-base 3.8.16-1.Final_redhat_00001.1.el8eap RHSA-2024:4390
Red Hat JBoss EAP 8 eap8-jose4j 0.9.6-1.redhat_00001.1.el8eap RHSA-2024:4390
Red Hat JBoss EAP 8 eap8-undertow 2.3.14-1.SP1_redhat_00001.1.el8eap RHSA-2024:4390
Red Hat JBoss EAP 8 eap8-wildfly +3 8.0.2-5.GA_redhat_00012.1.el8eap RHSA-2024:4390
Red Hat JBoss EAP 7 eap7-bouncycastle +5 1.78.1-1.redhat_00002.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-hal-console 3.3.23-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.5.17-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-jandex 2.4.5-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.29-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-jboss-server-migration +2 1.10.0-37.Final_redhat_00037.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.8.16-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-log4j-jboss-logmanager 1.3.1-1.Final_redhat_00002.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-netty +28 4.1.108-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-netty-xnio-transport 0.1.10-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-undertow 2.2.33-1.SP1_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-wildfly +4 7.4.18-1.GA_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk17 7.4.18-1.GA_redhat_00001.1.el8eap RHSA-2024:5145, RHSA-2024:5144
Red Hat JBoss Core Services 1 jbcs-httpd24-curl +2 8.7.1-2.el7jbcs RHSA-2024:2693
Red Hat JBoss Core Services 1 jbcs-httpd24-httpd +6 2.4.57-10.el7jbcs RHSA-2024:2693
Red Hat JBoss Core Services 1 jbcs-httpd24-mod_http2 1.15.19-37.el7jbcs RHSA-2024:2693
Red Hat JBoss Core Services 1 jbcs-httpd24-mod_jk +1 1.2.49-6.redhat_1.el7jbcs RHSA-2024:2693
Red Hat JBoss Core Services 1 jbcs-httpd24-mod_md 1:2.4.24-6.el7jbcs RHSA-2024:2693
Red Hat JBoss Core Services 1 jbcs-httpd24-mod_proxy_cluster 1.3.20-4.el7jbcs RHSA-2024:2693
Red Hat JBoss Core Services 1 jbcs-httpd24-mod_security 2.9.3-36.el7jbcs RHSA-2024:2693
Red Hat JBoss Core Services 1 jbcs-httpd24-mod_ssl +1 1:2.4.57-10.el7jbcs RHSA-2024:2693
Red Hat JBoss Core Services 1 jbcs-httpd24-nghttp2 +1 1.43.0-13.el7jbcs RHSA-2024:2693

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 mod_http2 1.15.19-5.el9_3.1 ALSA-2024:2564, ALSA-2024:1872
AlmaLinux 8 httpd +6 2.4.37-62.module_el8.9.0+3646+acd210d0 ALSA-2024:1786
AlmaLinux 8 mod_http2 1.15.7-8.module_el8.9.0+3809+48080a14.5.alma.1 ALSA-2024:1786
AlmaLinux 8 mod_md 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa ALSA-2024:1786
AlmaLinux 8 mod_ssl +1 1:2.4.37-62.module_el8.9.0+3646+acd210d0 ALSA-2024:1786

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 mod_http2 2.0.26-2.el9_4 RLSA-2024:2564
Rocky Linux 8 httpd 2.4.37-62.module+el8.9.0+1436+2b7d5021 RLSA-2024:1786
Rocky Linux 8 mod_http2 1.15.7-8.module+el8.9.0+1370+89cc8ad5.3 RLSA-2024:1786
Rocky Linux 8 mod_md 1:2.0.8-8.module+el8.9.0+1370+89cc8ad5 RLSA-2024:1786
ReleasePackageFixed inAdvisory
SLES 15 SP6 apache2 2.4.51-150400.6.17.1 SUSE-SU-2024:1963-1, SUSE-SU-2024:1868-1
SLES 15 SP6 apache2-devel +4 2.4.58-150600.5.3.1 SUSE-SU-2024:1963-1
SLES 15 SP5 apache2 2.4.51-150400.6.17.1 SUSE-SU-2026:2686-1, SUSE-SU-2024:1868-1
SLES 15 SP4 apache2 2.4.51-150400.6.17.1 SUSE-SU-2026:2686-1, SUSE-SU-2024:1868-1
SLES 15 SP3 apache2 2.4.51-150200.3.62.1 SUSE-SU-2024:1788-1
SLES 15 SP2 apache2 2.4.51-150200.3.62.1 SUSE-SU-2024:1788-1
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 apache2 +1 2.4.51-35.41.1 SUSE-SU-2024:1627-1
SLES for SAP 15 SP5 apache2 2.4.66-150400.6.57.1 SUSE-SU-2026:2686-1
SLES for SAP 15 SP4 apache2 2.4.51-150400.6.17.1 SUSE-SU-2026:2686-1, SUSE-SU-2024:1868-1
SLES for SAP 15 SP3 apache2 2.4.51-150200.3.62.1 SUSE-SU-2024:1788-1
SLES for SAP 15 SP2 apache2 2.4.51-150200.3.62.1 SUSE-SU-2024:1788-1
SLES for SAP 12 SP5 apache2 +1 2.4.51-35.41.1 SUSE-SU-2024:1627-1
SLE HPC 15 SP5 apache2 2.4.66-150400.6.57.1 SUSE-SU-2026:2686-1
SLE HPC 15 SP4 apache2 2.4.51-150400.6.17.1 SUSE-SU-2026:2686-1, SUSE-SU-2024:1868-1
SLE HPC 15 SP3 apache2 2.4.51-150200.3.62.1 SUSE-SU-2024:1788-1
SLE HPC 15 SP2 apache2 2.4.51-150200.3.62.1 SUSE-SU-2024:1788-1
SUSE Manager Server 4.3 apache2 2.4.51-150400.6.17.1 SUSE-SU-2024:1868-1
SUSE Manager Proxy 4.3 apache2 2.4.51-150400.6.17.1 SUSE-SU-2024:1868-1
SUSE Enterprise Storage 7.1 apache2 2.4.51-150200.3.62.1 SUSE-SU-2024:1788-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.6 apache2 +6 2.4.58-150600.5.3.1 SUSE-SU-2024:1963-1
openSUSE Leap 15.5 apache2 2.4.51-150400.6.17.1 SUSE-SU-2024:1868-1
ReleasePackageFixed inAdvisory
Alpine v3.24 apache2 2.4.59-r0 —
Alpine v3.23 apache2 2.4.59-r0 —
Alpine v3.22 apache2 2.4.59-r0 —
Alpine v3.21 apache2 2.4.59-r0 —
Alpine v3.20 apache2 2.4.59-r0 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 apache2 2.4.59-r0 —
Alpine v3.18 apache2 2.4.59-r0 —
Alpine v3.17 apache2 2.4.59-r0 —
Alpine v3.16 apache2 2.4.59-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 mod_http2 2.0.27-1.amzn2023.0.2 ALAS2023-2024-595
Amazon Linux 2 mod_http2 1.15.19-1.amzn2.0.2 ALAS2-2024-2524

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 httpd 2.4.61-1 —
Azure Linux 3 mod_http2 2.0.29-3 —
Azure Linux 2 (CBL-Mariner) httpd 2.4.59-1 —
Azure Linux 2 (CBL-Mariner) mod_http2 No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 mod_http2 1.15.19-5.el9_3.1 ELSA-2024-2564, ELSA-2024-1872
Oracle Linux 8 httpd +6 2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23 ELSA-2024-1786
Oracle Linux 8 mod_http2 1.15.7-8.module+el8.9.0+90299+1db10a42.5 ELSA-2024-1786
Oracle Linux 8 mod_md 1:2.0.8-8.module+el8.9.0+90011+2f9c6a23 ELSA-2024-1786
Oracle Linux 8 mod_ssl +1 1:2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23 ELSA-2024-1786

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • lockness-Ko/CVE-2024-27316 ★ 18 · Apr 9, 2024

    Proof of concept (PoC) for CVE-2024-27316 (tested), CVE-2024-30255 (untested), CVE-2024-31309 (untested), CVE-2024-28182 (untested), CVE-2024-2653 (untested) and CVE-2024-27919 (untested)

  • aeyesec/CVE-2024-27316_poc ★ 2 · Apr 17, 2024

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 46

References