Homepage

Improper Input Validation The advisory has been revoked - it doesn't affect any version of package apache2  (opens in a new tab)

Threat Intelligence

Exploit Maturity
Proof of Concept
EPSS
79.07% (100th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1404-APACHE2-619447
  • published10 Sept 2020
  • disclosed5 Dec 2016
Report a new vulnerability Found a mistake?

Introduced: 5 Dec 2016

CVE-2016-8740  (opens in a new tab)
CWE-20  (opens in a new tab)
CWE-399  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:14.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream apache2 package and not the apache2 package as distributed by Ubuntu.

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.

References