Read the docs
TI-2024-18154 Aliases CVE-2024-27316GHSA-5qc4-82jh-h385

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

Priority HIGH 81CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 18 fixed, 21 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.88755 99th percentileScored 2026-11-07
Fix Partial Red Hat: 17 advisoriesRed Hat: 18 fixed, 21 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache HTTP Server2.4.17 – 2.4.58—No fix listedCNA
  • Apache HTTP Server VendorApache Affected 2.4.17 – 2.4.58 Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*2.4.17 to before 2.4.59VulnerableApache
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*38VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*39VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*40VulnerableFedoraproject
cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*9VulnerableNetApp
  • cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions 2.4.17 to before 2.4.59 Vulnerable ·Apache
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* Versions 40 Vulnerable ·Fedoraproject
  • cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:* Versions 9 Vulnerable ·NetApp

Remediation

Red Hat 17 advisories

  • RHSA-2025:16667 Released 2025-09-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.15 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-commons-beanutils-1.11.0-1.redhat_00001.1.el7eap, eap7-hornetq-2.4.11-1.Final_redhat_00001.1.el7eap, eap7-hornetq-commons-2.4.11-1.Final_redhat_00001.1.el7eap +30
  • RHSA-2025:16668 Released 2025-09-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.12 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-commons-beanutils-1.11.0-1.redhat_00001.1.ep7.el7, eap7-hibernate-validator-5.3.6-1.SP1_redhat_00001.1.ep7.el7, eap7-hibernate-validator-cdi-5.3.6-1.SP1_redhat_00001.1.ep7.el7 +7
  • RHSA-2024:5147 Released 2024-08-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.18 Security update
    • Red Hat JBoss Enterprise Application Platform io.netty.netty-codec-http-4.1.108.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.33.SP1-redhat-00001.jar, org.bouncycastle.bcprov-jdk18on-1.78.1.redhat-00002.pom
Show 14 more Red Hat advisories
  • RHSA-2024:5144 Released 2024-08-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.18 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-bouncycastle-1.78.1-1.redhat_00002.1.el8eap, eap7-bouncycastle-mail-1.78.1-1.redhat_00002.1.el8eap, eap7-bouncycastle-pg-1.78.1-1.redhat_00002.1.el8eap +47
  • RHSA-2024:5143 Released 2024-08-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.18 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-bouncycastle-1.78.1-1.redhat_00002.1.el7eap, eap7-bouncycastle-mail-1.78.1-1.redhat_00002.1.el7eap, eap7-bouncycastle-pg-1.78.1-1.redhat_00002.1.el7eap +47
  • RHSA-2024:5145 Released 2024-08-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.18 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-bouncycastle-1.78.1-1.redhat_00002.1.el9eap, eap7-bouncycastle-mail-1.78.1-1.redhat_00002.1.el9eap, eap7-bouncycastle-pg-1.78.1-1.redhat_00002.1.el9eap +47
  • RHSA-2024:4392 Released 2024-07-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.0.2 Security update
    • Red Hat JBoss Enterprise Application Platform 8
  • RHSA-2024:4390 Released 2024-07-08 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 8.0 security update
    • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-hibernate-6.2.26-1.Final_redhat_00001.1.el8eap, eap8-hibernate-core-6.2.26-1.Final_redhat_00001.1.el8eap, eap8-hibernate-envers-6.2.26-1.Final_redhat_00001.1.el8eap +8
    • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-hibernate-6.2.26-1.Final_redhat_00001.1.el9eap, eap8-hibernate-core-6.2.26-1.Final_redhat_00001.1.el9eap, eap8-hibernate-envers-6.2.26-1.Final_redhat_00001.1.el9eap +8
  • RHSA-2024:3402 Released 2024-05-28 · Red Hat rating Moderate
    mod_http2 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) mod_http2-1.15.19-4.el9_2.6
  • RHSA-2024:3417 Released 2024-05-28 · Red Hat rating Moderate
    mod_http2 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) mod_http2-1.15.19-3.el9_0.6
  • RHSA-2024:2907 Released 2024-05-20 · Red Hat rating Moderate
    httpd:2.4 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) httpd-2.4.37-47.module+el8.6.0+19809+6e655c60.7.aarch64::httpd:2.4, httpd-2.4.37-47.module+el8.6.0+19809+6e655c60.7.ppc64le::httpd:2.4, httpd-2.4.37-47.module+el8.6.0+19809+6e655c60.7.s390x::httpd:2.4 +38
  • RHSA-2024:2891 Released 2024-05-16 · Red Hat rating Moderate
    httpd:2.4 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) httpd-2.4.37-56.module+el8.8.0+19808+379766d6.7.aarch64::httpd:2.4, httpd-2.4.37-56.module+el8.8.0+19808+379766d6.7.ppc64le::httpd:2.4, httpd-2.4.37-56.module+el8.8.0+19808+379766d6.7.s390x::httpd:2.4 +38
  • RHSA-2024:2693 Released 2024-05-07 · Red Hat rating Moderate
    Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl-8.7.1-2.el7jbcs, jbcs-httpd24-httpd-2.4.57-10.el7jbcs, jbcs-httpd24-httpd-devel-2.4.57-10.el7jbcs +17
    • Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl-8.7.1-2.el8jbcs, jbcs-httpd24-httpd-2.4.57-10.el8jbcs, jbcs-httpd24-httpd-devel-2.4.57-10.el8jbcs +17
  • RHSA-2024:2694 Released 2024-05-07 · Red Hat rating Moderate
    Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update
    • Red Hat JBoss Core Services
  • RHSA-2024:2564 Released 2024-04-30 · Red Hat rating Moderate
    mod_http2 security update
    • Red Hat Enterprise Linux AppStream (v. 9) mod_http2-2.0.26-2.el9_4
  • RHSA-2024:1872 Released 2024-04-18 · Red Hat rating Important
    mod_http2 security update
    • Red Hat Enterprise Linux AppStream (v. 9) mod_http2-1.15.19-5.el9_3.1
  • RHSA-2024:1786 Released 2024-04-11 · Red Hat rating Important
    httpd:2.4/mod_http2 security update
    • Red Hat Enterprise Linux AppStream (v. 8) httpd-2.4.37-62.module+el8.9.0+19699+7a7a2044.aarch64::httpd:2.4, httpd-2.4.37-62.module+el8.9.0+19699+7a7a2044.ppc64le::httpd:2.4, httpd-2.4.37-62.module+el8.9.0+19699+7a7a2044.s390x::httpd:2.4 +38

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 2AffectedNo fix yet
Migration Toolkit for Applications 6AffectedNo fix planned: Will not fix
Migration Toolkit for RuntimesAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix planned: Will not fix
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Security 3AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Security 4AffectedNo fix planned: Will not fix
Red Hat Build of KeycloakAffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat JBoss Core ServicesAffectedNo fix yet
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Data Science (RHODS)AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat Service Interconnect 1AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
streams for Apache KafkaAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:1786
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:1872, RHSA-2024:2564
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2024:2907
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:2891
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2024:3417
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:3402
Red Hat JBoss Core ServicesFixed RHSA-2024:2694
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2024:2693
Red Hat JBoss Core Services on RHEL 8Fixed RHSA-2024:2693
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2024:5143
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2024:5144
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2024:5145
Red Hat JBoss EAP 8.0 for RHEL 8Fixed RHSA-2024:4390
Red Hat JBoss EAP 8.0 for RHEL 9Fixed RHSA-2024:4390
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2024:5147
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:16668
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2025:16667
Red Hat JBoss Enterprise Application Platform 8Fixed RHSA-2024:4392
Not affected: 25 products
  • .NET 6.0 on Red Hat Enterprise Linux
  • A-MQ Clients 2
  • Logging Subsystem for Red Hat OpenShift
  • Multicluster Engine for Kubernetes
  • OpenShift Serverless
  • Red Hat AMQ Broker 7
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 2
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Process Automation 7
  • Red Hat Software Collections
  • Red Hat build of Apache Camel - HawtIO 4
  • Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat build of Apache Camel for Spring Boot 3
  • Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Debezium 2
  • Red Hat build of OptaPlanner 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-27316
  2. 2026-10-03 Alias added: GHSA-5qc4-82jh-h385
  3. 2026-10-09 Fix available: RHSA-2024:2694 · Red Hat
  4. 2026-10-15 Fix available: Red Hat JBoss Core Services · Red Hat

References

Advisory 1

Other 4

  • TI-2021-18535 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-18417 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-25716 Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. KEVCVSS 3.1CRITICAL 9.1
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
  • TI-2019-00184 Use after free in Apache HTTP Server KEVCVSS 3.1HIGH 7.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
See all 349 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences