A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size li

Summary

A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage.

Timeline

1. Mar 26, 2018, 3:00 PM UTCCVE published
2. Sep 16, 2024, 5:22 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache HTTP Server

  2.2.0 to 2.4.29

References 25