Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2016-8740

HighPublic exploit

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in…

Published Dec 5, 2016 · Updated Sep 23, 2026 · Also known as DEBIAN-CVE-2016-8740, SUSE-SU-2017:0203-1

Key Facts

Patch immediately
  • CVE-2016-8740 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting HTTP Server (Apache), apache2 (debian), rootio-apache2 and 11 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
  • EPSS estimates a 79% probability of exploitation in the next 30 days.
  • Fixed versions are available, including apache2 2.4.23-16.3, apache2 2.4.23-6.1, apache2 2.4.25-1.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

7.5

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (30-day exploit likelihood)

79%

Higher than 99.5% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2016-8740 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.

Affected Products

61 affected entries in total
ProductAffected versionsFixed in
HTTP ServerApache2.4.17, 2.4.18, 2.4.19, 2.4.20, 2.4.21, 2.4.22, 2.4.23, >= 2.4.17 - 2.4.23n/a
apache2debianSee advisory2.4.25-1
rootio-apache2rootioSee advisory2.4.25-1
httpd24-httpdredhatSee advisory0:2.4.25-9.el6
jbcs-httpd24-httpdredhatSee advisory0:2.4.23-120.jbcs.el6
9 more affected products in the full CVE brief

Patched Releases

apache2

2.4.23-16.3, 2.4.23-6.1, 2.4.25-1, 2.4.49-1.1

apache2-devel

2.4.23-16.3, 2.4.23-6.1

apache2-doc

2.4.23-16.3, 2.4.23-6.1

apache2-event

2.4.23-6.1

apache2-example-pages

2.4.23-16.3, 2.4.23-6.1

apache2-prefork

2.4.23-16.3, 2.4.23-6.1

apache2-utils

2.4.23-16.3, 2.4.23-6.1

apache2-worker

2.4.23-16.3, 2.4.23-6.1

httpd24-httpd

0:2.4.25-9.el6, 0:2.4.25-9.el7

jbcs-httpd24-httpd

0:2.4.23-120.jbcs.el6, 0:2.4.23-120.jbcs.el7

jbcs-httpd24-mod_security

0:2.9.1-19.GA.jbcs.el6, 0:2.9.1-19.GA.jbcs.el7

jbcs-httpd24-openssl

1:1.0.2h-13.jbcs.el6, 1:1.0.2h-13.jbcs.el7

rootio-apache2

2.4.25-1

Timeline

  1. Publicly disclosed

    Dec 5, 2016

  2. Last updated

    Sep 23, 2026

Weakness Type

  • CWE-20 Improper Input Validation
  • CWE-399
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2016-8740 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo