CVE-2016-8740 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 98%

Affected Products (NVD)

Vendor	Product	Version
apache	http_server	2.4.17
apache	http_server	2.4.18
apache	http_server	2.4.19
apache	http_server	2.4.20
apache	http_server	2.4.21
apache	http_server	2.4.22
apache	http_server	2.4.23

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

apache2

bookworm	2.4.62-1~deb12u1 fixed
bookworm (security)	2.4.62-1~deb12u2 fixed
bullseye	2.4.62-1~deb11u1 fixed
bullseye (security)	2.4.62-1~deb11u2 fixed
jessie	not-affected
sid	2.4.62-3 fixed
trixie	2.4.62-3 fixed
wheezy	not-affected

Ubuntu Releases

Ubuntu Product

Codename

apache2

precise	not-affected
trusty	not-affected
xenial	not-affected
yakkety	not-affected
zesty	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

apache2

suse enterprise desktop 15 SP2	2.4.43-1.15 fixed
suse enterprise desktop 15 SP3	2.4.43-3.17.1 fixed
suse enterprise desktop 15 SP4	2.4.51-150400.4.6 fixed
suse enterprise desktop 15 SP5	2.4.51-150400.6.11.1 fixed
suse enterprise desktop 15 SP6	2.4.58-150600.3.2 fixed
suse enterprise desktop 15 SP7	2.4.62-150700.2.2 fixed
suse enterprise sap 12 SP2	2.4.23-16.3 fixed
suse enterprise sap 12 SP5	2.4.23-29.43.1 fixed
suse enterprise sap 15	2.4.33-1.28 fixed
suse enterprise sap 15 SP1	2.4.33-3.15.1 fixed
suse enterprise sap 15 SP2	2.4.43-1.15 fixed
suse enterprise sap 15 SP3	2.4.43-3.17.1 fixed
suse enterprise sap 15 SP4	2.4.51-150400.4.6 fixed
suse enterprise sap 15 SP5	2.4.51-150400.6.11.1 fixed
suse enterprise sap 15 SP6	2.4.58-150600.3.2 fixed
suse enterprise sap 15 SP7	2.4.62-150700.2.2 fixed
suse enterprise server 12 SP2	2.4.23-16.3 fixed
suse enterprise server 12 SP5	2.4.23-29.43.1 fixed
suse enterprise server 15	2.4.33-1.28 fixed
suse enterprise server 15 SP1	2.4.33-3.15.1 fixed
suse enterprise server 15 SP2	2.4.43-1.15 fixed
suse enterprise server 15 SP3	2.4.43-3.17.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.4.6 fixed
suse enterprise server 15 SP5	2.4.51-150400.6.11.1 fixed
suse enterprise server 15 SP6	2.4.58-150600.3.2 fixed
suse enterprise server 15 SP7	2.4.62-150700.2.2 fixed

apache2-devel

suse enterprise sap 15	2.4.33-1.28 fixed
suse enterprise sap 15 SP1	2.4.33-3.15.1 fixed
suse enterprise sap 15 SP2	2.4.43-1.15 fixed
suse enterprise sap 15 SP3	2.4.43-3.17.1 fixed
suse enterprise sap 15 SP4	2.4.51-150400.4.6 fixed
suse enterprise sap 15 SP7	2.4.62-150700.2.1 fixed
suse enterprise server 15	2.4.33-1.28 fixed
suse enterprise server 15 SP1	2.4.33-3.15.1 fixed
suse enterprise server 15 SP2	2.4.43-1.15 fixed
suse enterprise server 15 SP3	2.4.43-3.17.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.4.6 fixed
suse enterprise server 15 SP7	2.4.62-150700.2.1 fixed

apache2-doc

suse enterprise sap 12 SP2	2.4.23-16.3 fixed
suse enterprise sap 12 SP5	2.4.23-29.43.1 fixed
suse enterprise sap 15	2.4.33-1.28 fixed
suse enterprise sap 15 SP1	2.4.33-3.15.1 fixed
suse enterprise sap 15 SP2	2.4.43-1.15 fixed
suse enterprise sap 15 SP3	2.4.43-3.17.1 fixed
suse enterprise sap 15 SP4	2.4.51-150400.4.6 fixed
suse enterprise sap 15 SP7	2.4.51-150400.6.43.1 fixed
suse enterprise server 12 SP2	2.4.23-16.3 fixed
suse enterprise server 12 SP5	2.4.23-29.43.1 fixed
suse enterprise server 15	2.4.33-1.28 fixed
suse enterprise server 15 SP1	2.4.33-3.15.1 fixed
suse enterprise server 15 SP2	2.4.43-1.15 fixed
suse enterprise server 15 SP3	2.4.43-3.17.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.4.6 fixed
suse enterprise server 15 SP7	2.4.51-150400.6.43.1 fixed

apache2-example-pages

suse enterprise sap 12 SP2	2.4.23-16.3 fixed
suse enterprise sap 12 SP5	2.4.23-29.43.1 fixed
suse enterprise server 12 SP2	2.4.23-16.3 fixed
suse enterprise server 12 SP5	2.4.23-29.43.1 fixed

apache2-prefork

suse enterprise desktop 15 SP2	2.4.43-1.15 fixed
suse enterprise desktop 15 SP3	2.4.43-3.17.1 fixed
suse enterprise desktop 15 SP4	2.4.51-150400.4.6 fixed
suse enterprise desktop 15 SP5	2.4.51-150400.6.11.1 fixed
suse enterprise desktop 15 SP6	2.4.58-150600.3.2 fixed
suse enterprise desktop 15 SP7	2.4.62-150700.2.4 fixed
suse enterprise sap 12 SP2	2.4.23-16.3 fixed
suse enterprise sap 12 SP5	2.4.23-29.43.1 fixed
suse enterprise sap 15	2.4.33-1.28 fixed
suse enterprise sap 15 SP1	2.4.33-3.15.1 fixed
suse enterprise sap 15 SP2	2.4.43-1.15 fixed
suse enterprise sap 15 SP3	2.4.43-3.17.1 fixed
suse enterprise sap 15 SP4	2.4.51-150400.4.6 fixed
suse enterprise sap 15 SP5	2.4.51-150400.6.11.1 fixed
suse enterprise sap 15 SP6	2.4.58-150600.3.2 fixed
suse enterprise sap 15 SP7	2.4.62-150700.2.4 fixed
suse enterprise server 12 SP2	2.4.23-16.3 fixed
suse enterprise server 12 SP5	2.4.23-29.43.1 fixed
suse enterprise server 15	2.4.33-1.28 fixed
suse enterprise server 15 SP1	2.4.33-3.15.1 fixed
suse enterprise server 15 SP2	2.4.43-1.15 fixed
suse enterprise server 15 SP3	2.4.43-3.17.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.4.6 fixed
suse enterprise server 15 SP5	2.4.51-150400.6.11.1 fixed
suse enterprise server 15 SP6	2.4.58-150600.3.2 fixed
suse enterprise server 15 SP7	2.4.62-150700.2.4 fixed

apache2-utils

suse enterprise desktop 15 SP2	2.4.43-1.15 fixed
suse enterprise desktop 15 SP3	2.4.43-3.17.1 fixed
suse enterprise desktop 15 SP4	2.4.51-150400.4.6 fixed
suse enterprise desktop 15 SP5	2.4.51-150400.6.11.1 fixed
suse enterprise sap 12 SP2	2.4.23-16.3 fixed
suse enterprise sap 12 SP5	2.4.23-29.43.1 fixed
suse enterprise sap 15	2.4.33-1.28 fixed
suse enterprise sap 15 SP1	2.4.33-3.15.1 fixed
suse enterprise sap 15 SP2	2.4.43-1.15 fixed
suse enterprise sap 15 SP3	2.4.43-3.17.1 fixed
suse enterprise sap 15 SP4	2.4.51-150400.4.6 fixed
suse enterprise sap 15 SP5	2.4.51-150400.6.11.1 fixed
suse enterprise sap 15 SP7	2.4.62-150700.2.4 fixed
suse enterprise server 12 SP2	2.4.23-16.3 fixed
suse enterprise server 12 SP5	2.4.23-29.43.1 fixed
suse enterprise server 15	2.4.33-1.28 fixed
suse enterprise server 15 SP1	2.4.33-3.15.1 fixed
suse enterprise server 15 SP2	2.4.43-1.15 fixed
suse enterprise server 15 SP3	2.4.43-3.17.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.4.6 fixed
suse enterprise server 15 SP5	2.4.51-150400.6.11.1 fixed
suse enterprise server 15 SP7	2.4.62-150700.2.4 fixed

apache2-worker

suse enterprise sap 12 SP2	2.4.23-16.3 fixed
suse enterprise sap 12 SP5	2.4.23-29.43.1 fixed
suse enterprise sap 15	2.4.33-1.28 fixed
suse enterprise sap 15 SP1	2.4.33-3.15.1 fixed
suse enterprise sap 15 SP2	2.4.43-1.15 fixed
suse enterprise sap 15 SP3	2.4.43-3.17.1 fixed
suse enterprise sap 15 SP4	2.4.51-150400.4.6 fixed
suse enterprise sap 15 SP7	2.4.62-150700.2.4 fixed
suse enterprise server 12 SP2	2.4.23-16.3 fixed
suse enterprise server 12 SP5	2.4.23-29.43.1 fixed
suse enterprise server 15	2.4.33-1.28 fixed
suse enterprise server 15 SP1	2.4.33-3.15.1 fixed
suse enterprise server 15 SP2	2.4.43-1.15 fixed
suse enterprise server 15 SP3	2.4.43-3.17.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.4.6 fixed
suse enterprise server 15 SP7	2.4.62-150700.2.4 fixed

Known Exploits!

Common Weakness Enumeration

CWE-20 - Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Vulnerability Media Exposure

[ENGLISH] New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare
Cybersecurity researchers have discovered a remote denial-of-service exploit that affects major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. The vulnerability has been codenamed HTTP/2 Bomb by Calif. "The vulnerable behavior exists in each server's default HTTP/2 configuration," the company said, adding it was discovered by OpenAI Codex by chaining
Published: 2026-06-03T14:03:35+05:30

References

http://packetstormsecurity.com/files/140023/Apache-HTTPD-Web-Server-2.4.23-Memory-Exhaustion.html

http://rhn.redhat.com/errata/RHSA-2017-1415.html

http://www.securityfocus.com/bid/94650

http://www.securitytracker.com/id/1037388

https://access.redhat.com/errata/RHSA-2017:1161

https://access.redhat.com/errata/RHSA-2017:1413

https://access.redhat.com/errata/RHSA-2017:1414

https://github.com/apache/httpd/commit/29c63b786ae028d82405421585e91283c8fa0da3

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us

https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

https://security.gentoo.org/glsa/201701-36

https://security.netapp.com/advisory/ntap-20180423-0001/

https://support.apple.com/HT208221

https://www.exploit-db.com/exploits/40909/

https://www.tenable.com/security/tns-2017-04

http://packetstormsecurity.com/files/140023/Apache-HTTPD-Web-Server-2.4.23-Memory-Exhaustion.html

http://rhn.redhat.com/errata/RHSA-2017-1415.html

http://www.securityfocus.com/bid/94650

http://www.securitytracker.com/id/1037388

https://access.redhat.com/errata/RHSA-2017:1161

https://access.redhat.com/errata/RHSA-2017:1413

https://access.redhat.com/errata/RHSA-2017:1414

https://github.com/apache/httpd/commit/29c63b786ae028d82405421585e91283c8fa0da3

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us

https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

https://security.gentoo.org/glsa/201701-36

https://security.netapp.com/advisory/ntap-20180423-0001/

https://support.apple.com/HT208221

https://www.exploit-db.com/exploits/40909/

https://www.tenable.com/security/tns-2017-04