CVE-2024-27316
Published: 27 March 2024
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
apache2 Launchpad, Ubuntu, Debian |
bionic |
Released
(2.4.29-1ubuntu4.27+esm2)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
| focal |
Released
(2.4.41-4ubuntu3.17)
|
|
| jammy |
Released
(2.4.52-1ubuntu4.9)
|
|
| mantic |
Released
(2.4.57-2ubuntu2.4)
|
|
| noble |
Released
(2.4.58-1ubuntu8.1)
|
|
| trusty |
Needs triage
|
|
| upstream |
Released
(2.4.59-1)
|
|
| xenial |
Released
(2.4.18-2ubuntu3.17+esm12)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
|
Patches: upstream: https://github.com/apache/httpd/commit/0d73970ec161300a55b630f71bbf72b5c41f28b9 |
||
References
- https://kb.cert.org/vuls/id/421644
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://ubuntu.com/security/notices/USN-6729-1
- https://www.cve.org/CVERecord?id=CVE-2024-27316
- https://ubuntu.com/security/notices/USN-6729-2
- https://ubuntu.com/security/notices/USN-6729-3
- NVD
- Launchpad
- Debian