CVE-2024-27316

Published: Apr 4, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

Affected (5)

Products: Apache: Http Server · Fedoraproject: Fedora · Netapp: Ontap

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	From 2.4.17 to 2.4.59

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 38
Fedoraproject Fedora	Version 39
Fedoraproject Fedora	Version 40

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Ontap	Version 9

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (15)

http://seclists.org/fulldisclosure/2024/Jul/18

Source: security@apache.org

http://www.openwall.com/lists/oss-security/2024/04/04/4

Source: security@apache.org

Mailing List

https://httpd.apache.org/security/vulnerabilities_24.html

Source: security@apache.org

ProductRelease Notes

https://support.apple.com/kb/HT214119

Source: security@apache.org

https://www.openwall.com/lists/oss-security/2024/04/03/16

Source: security@apache.org

http://seclists.org/fulldisclosure/2024/Jul/18