CVE-2017-7679apache Memory Corruption
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.
Published Jun 20, 2017 · Updated Sep 23, 2026 · Also known as ALPINE-CVE-2017-7679, DEBIAN-CVE-2017-7679, UBUNTU-CVE-2017-7679
Key Facts
Patch in the next maintenance window- CVE-2017-7679 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting HTTP Server (Apache), apache (arch), apache2 (alpine) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 39% probability of exploitation in the next 30 days.
- Fixed versions are available, including apache 2.4.26-1, HTTP Server 2.2.33, apache2 2.2.22-13+deb7u9.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Scores
CVSS v3.1
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
39%
Higher than 98.5% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
46/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.
Affected Products
194 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| HTTP ServerApache | >= 2.2.0 to 2.2.32 | 2.2.33 |
| apachearch | See advisory | 2.4.26-1 |
| apache2alpine | See advisory | 2.4.26-r0 |
| rootio-apache2rootio | See advisory | 2.4.25-4 |
| httpd24-develamazon | See advisory | 2.4.27-3.71.amzn1 |
Patched Releases
apache
2.4.26-1
HTTP Server
2.2.33
apache2
2.2.22-13+deb7u9, 2.2.34-70.12.1, 2.4.10-10+deb8u9, 2.4.10-14.28.1, 2.4.16-20.10.1, 2.4.18-2ubuntu3.3, 2.4.23-28.1, 2.4.23-8.6.1, 2.4.25-3+deb9u1, 2.4.25-4, 2.4.26-r0, 2.4.7-1ubuntu4.16
apache2-devel
2.2.34-70.12.1, 2.4.23-28.1, 2.4.23-8.6.1
apache2-doc
2.2.34-70.12.1, 2.4.10-14.28.1, 2.4.16-20.10.1, 2.4.23-28.1, 2.4.23-8.6.1
apache2-event
2.4.23-8.6.1
apache2-example-pages
2.2.34-70.12.1, 2.4.10-14.28.1, 2.4.16-20.10.1, 2.4.23-28.1, 2.4.23-8.6.1
apache2-prefork
2.2.34-70.12.1, 2.4.10-14.28.1, 2.4.16-20.10.1, 2.4.23-28.1, 2.4.23-8.6.1
apache2-utils
2.2.34-70.12.1, 2.4.10-14.28.1, 2.4.16-20.10.1, 2.4.23-28.1, 2.4.23-8.6.1
apache2-worker
2.2.34-70.12.1, 2.4.10-14.28.1, 2.4.16-20.10.1, 2.4.23-28.1, 2.4.23-8.6.1
httpd
0:2.2.15-47.el6_7.5, 0:2.4.6-40.el7_2.6, 2.2.15-60.0.1.el6_9.5, 2.2.34-1.12.amzn1, 2.4.6-67.0.1.el7_4.2
httpd-devel
2.2.15-60.0.1.el6_9.5, 2.2.34-1.12.amzn1, 2.4.6-67.0.1.el7_4.2
httpd-manual
2.2.15-60.0.1.el6_9.5, 2.2.34-1.12.amzn1, 2.4.6-67.0.1.el7_4.2
httpd-tools
2.2.15-60.0.1.el6_9.5, 2.2.34-1.12.amzn1, 2.4.6-67.0.1.el7_4.2
httpd24
2.4.27-3.71.amzn1
httpd24-devel
2.4.27-3.71.amzn1
httpd24-httpd
0:2.4.25-9.el6.1, 0:2.4.25-9.el7.1, 2.4.25-9.0.1.el6.1
httpd24-httpd-devel
2.4.25-9.0.1.el6.1
httpd24-httpd-manual
2.4.25-9.0.1.el6.1
httpd24-httpd-tools
2.4.25-9.0.1.el6.1
httpd24-manual
2.4.27-3.71.amzn1
httpd24-mod_ldap
2.4.25-9.0.1.el6.1
httpd24-mod_proxy_html
1:2.4.25-9.0.1.el6.1
httpd24-mod_session
2.4.25-9.0.1.el6.1
httpd24-mod_ssl
1:2.4.25-9.0.1.el6.1
Timeline
Publicly disclosed
Jun 20, 2017
Last updated
Sep 23, 2026
Weakness Type
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-125 Out-of-bounds Read
- CWE-126 Buffer Over-read
References
- advisorysecurity.alpinelinux.org · CVE-2017-7679
- advisorysecurity-tracker.debian.org · CVE-2017-7679
- advisoryubuntu.com · CVE-2017-7679
- advisorycve.org · CVERecord
- advisoryRHSA-2017:2478
FAQ
Common Questions.
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.
Affected: HTTP Server (Apache) versions >= 2.2.0 to 2.2.32; apache (arch); apache2 (alpine), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including apache 2.4.26-1, HTTP Server 2.2.33, apache2 2.2.22-13+deb7u9.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2017-7679 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo