Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, o

Summary

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.

Timeline

1. Sep 18, 2017Public exploit on Exploit-DB

   EDB-42745

2. Sep 18, 2017, 3:00 PM UTCCVE published
3. Nov 4, 2025, 4:09 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache HTTP Server

  Version range not reported

References 31