CVE-2024-27316·Apache vulnerability

Affected versions

How to fix this CVE

Update Apache HTTP Server to version 2.4.59 or later to patch the HTTP/2 header buffering vulnerability. This fix prevents memory exhaustion attacks that exploit improper handling of oversized incoming headers. Prioritize this update for production systems exposed to untrusted network traffic, as the vulnerability requires no authentication or user interaction.

sudo dnf update httpd

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

Repeated or malformed HTTP/2 HEADERS frames with abnormally large header block sizes (exceeding LimitRequestFields or LimitRequestFieldSize thresholds) sent from a single client IP without completing the request lifecycle. Log pattern: 'h2.*headers.*exceeding' or abnormal increases in child process memory usage correlated with HTTP/2 connections.

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement HTTP/2 header size limits at the WAF level by rejecting HEADERS frames or requests with cumulative header size exceeding a reasonable threshold (e.g., 16KB total). Set rate limits on header-heavy requests per IP to mitigate header flooding attempts before they reach the Apache backend.

How to check if you are affected

1. Run 'apache2ctl -v' or 'httpd -v' to check the currently installed Apache version and compare it against 2.4.59.
2. Verify HTTP/2 support is enabled by checking if mod_http2 is loaded: grep -i 'mod_http2' /etc/apache2/mods-enabled/* or httpd -M | grep http2.
3. Search Apache access and error logs for repeated or sustained HTTP/2 HEADERS frame activity without corresponding request completion: grep -i 'h2' /var/log/apache2/error.log | tail -100.
4. After patching, re-run 'apache2ctl -v' or 'httpd -v' to confirm the version is 2.4.59 or later, then restart Apache with 'sudo systemctl restart apache2' or 'sudo systemctl restart httpd' and verify normal operation.

FAQ

Related Apache CVEs

References

• http://seclists.org/fulldisclosure/2024/Jul/18
• http://www.openwall.com/lists/oss-security/2024/04/04/4
• https://httpd.apache.org/security/vulnerabilities_24.html
• https://support.apple.com/kb/HT214119
• https://www.openwall.com/lists/oss-security/2024/04/03/16