Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2…
Priority HIGH 66CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 8 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.
Why it matters now
EPSS 0.566 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 3 advisoriesRed Hat: 8 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Apache HTTP Server | 2.4.20 to 2.4.43 | — | No fix listed | CNA |
- Apache HTTP Server Vendor— Affected 2.4.20 to 2.4.43 Fixed in — No fix listed CNA
CPE configurations NVD · 19
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | 2.4.20 to before 2.4.44 | Vulnerable | Apache |
| cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* | 20.04 | Vulnerable | Canonical |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* | 15.2 | Vulnerable | openSUSE |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
- cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions 2.4.20 to before 2.4.44 Vulnerable ·Apache
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
Show 9 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* | 8.2.0 – 8.2.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* | 8.2.0 – 8.2.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* | 8.2.0 – 8.2.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* | 12.4.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:* | 11.1.2.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* | 17.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* | 17.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* | 17.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* | 8.8 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* Versions 12.4.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:* Versions 11.1.2.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* Versions 17.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* Versions 17.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* Versions 17.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Oracle
Remediation
Red Hat 3 advisories
- RHSA-2021:1809 Released 2021-05-18 · Red Hat rating Moderatehttpd:2.4 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) httpd-2.4.37-39.module+el8.4.0+9658+b87b2deb.aarch64::httpd:2.4, httpd-2.4.37-39.module+el8.4.0+9658+b87b2deb.ppc64le::httpd:2.4, httpd-2.4.37-39.module+el8.4.0+9658+b87b2deb.s390x::httpd:2.4 +38
- RHSA-2020:4384 Released 2020-10-28 · Red Hat rating ModerateRed Hat JBoss Core Services Apache HTTP Server 2.4.37 SP5 security update
- Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-apr-1.6.3-104.jbcs.el6, jbcs-httpd24-apr-devel-1.6.3-104.jbcs.el6, jbcs-httpd24-apr-util-1.6.1-75.jbcs.el6 +38
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-1.6.3-104.jbcs.el7, jbcs-httpd24-apr-devel-1.6.3-104.jbcs.el7, jbcs-httpd24-apr-util-1.6.1-75.jbcs.el7 +39
- RHSA-2020:4383 Released 2020-10-28 · Red Hat rating ModerateRed Hat JBoss Core Services Apache HTTP Server 2.4.37 SP5 security update
- Red Hat JBoss Core Services
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Apache HTTP Server — GLSA-202008-04
4 records Highest priority Priority CRITICAL 1 CRITICAL, 2 HIGH, 1 LOW
Other records, highest priority first
- TI-2020-09644 Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCEPriority CRITICAL 85
- TI-2020-07599 Apache HTTP Server versions 2.4.20 to 2.4.43.Priority HIGH 75
- TI-2020-09645 Insufficient verification of data authenticity in Apache HTTP ServerPriority LOW 34
- Advisory ·
Apache HTTP Server — openSUSE-SU-2020:1285
3 records Highest priority Priority CRITICAL 1 CRITICAL, 2 HIGH
Other records, highest priority first
- TI-2020-09644 Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCEPriority CRITICAL 85
- TI-2020-07599 Apache HTTP Server versions 2.4.20 to 2.4.43.Priority HIGH 75
Show 4 more groups
- Advisory ·
Apache HTTP Server — openSUSE-SU-2020:1293
3 records Highest priority Priority CRITICAL 1 CRITICAL, 2 HIGH
Other records, highest priority first
- TI-2020-09644 Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCEPriority CRITICAL 85
- TI-2020-07599 Apache HTTP Server versions 2.4.20 to 2.4.43.Priority HIGH 75
- Advisory ·
Apache HTTP Server — openSUSE-SU-2020:1792
2 records Highest priority Priority HIGH 2 HIGH
Other records, highest priority first
- TI-2020-07599 Apache HTTP Server versions 2.4.20 to 2.4.43.Priority HIGH 75
- Advisory ·
Apache HTTP Server — FEDORA-2020-8122a8daa2
2 records Highest priority Priority HIGH 2 HIGH
Other records, highest priority first
- TI-2020-07599 Apache HTTP Server versions 2.4.20 to 2.4.43.Priority HIGH 75
- Advisory ·
Apache HTTP Server — FEDORA-2020-b58dc5df38
2 records Highest priority Priority HIGH 2 HIGH
Other records, highest priority first
- TI-2020-07599 Apache HTTP Server versions 2.4.20 to 2.4.43.Priority HIGH 75
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Enterprise Web Server 2 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:1809 |
| Red Hat JBoss Core Services | Fixed | RHSA-2020:4383 |
| Red Hat JBoss Core Services on RHEL 6 Server | Fixed | RHSA-2020:4384 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2020:4384 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | — |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) | Fixed | — |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | — |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | — |
Not affected: 3 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
Timeline
- 2026-10-02 Threatist record created from CVE-2020-11993
- 2026-10-03 Alias added: GHSA-89mq-r3q6-9q3q
References
Exploit 1
Patch 13
- [httpd-dev] 20200808 Security announcements for CVE-2020-9490/CVE-2020-11993 ?
- [httpd-dev] 20200811 Which version fixed the CVE-2020-9490, CVE-2020-11984 and CVE-2020-11993 vulnerabilities?
- [httpd-dev] 20200811 Re: Which version fixed the CVE-2020-9490, CVE-2020-11984 and CVE-2020-11993 vulnerabilities?
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
- [httpd-cvs] 20210330 svn commit: r1073143 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/
- [httpd-cvs] 20210330 svn commit: r1888194 [13/13] - /httpd/site/trunk/content/security/json/
- [httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073139 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/
- [httpd-cvs] 20210330 svn commit: r1073149 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/
- [httpd-cvs] 20210330 svn commit: r1073171 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-11984.json security/json/CVE-2020-11993.json security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1888228 - in /httpd/site/trunk/content/security/json: CVE-2020-11984.json CVE-2020-11993.json
- [httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
Advisory 12
- https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11993
- GLSA-202008-04
- USN-4458-1
- FEDORA-2020-8122a8daa2
- FEDORA-2020-b58dc5df38
- openSUSE-SU-2020:1285
- openSUSE-SU-2020:1293
- DSA-4757
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20200814-0005/
- openSUSE-SU-2020:1792
- https://www.oracle.com/security-alerts/cpujan2021.html
Sources
- CVE-2020-11993 · CVE Program
- CVE-2020-11993 · NVD
- FIRST EPSS
- GHSA-89mq-r3q6-9q3q · GitHub Advisory Database · CC BY 4.0
- CVE-2020-11993 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences