Vulnerability record · CVE-2016-8740 · published 5 December 2016
CVE-2016-8740: Apache HTTP Server mod_http2 header length flaw allows memory exhaustion DoS
Apache · Http Server
The mod_http2 module in Apache HTTP Server 2.4.17 through 2.4.23 fails to restrict request-header length when the Protocols configuration includes h2 or h2c. A remote attacker can send crafted CONTINUATION frames in an HTTP/2 request to drive unbounded memory consumption. This matters because it is a network-reachable denial of service against a widely deployed web server, and the affected versions are explicitly stated in the record.
Description
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityNetwork-reachable, unauthenticated denial of service with a very high EPSS score and a public exploit reference, though not listed in KEV and limited to availability impact.
What it is
The mod_http2 module in Apache HTTP Server 2.4.17 through 2.4.23 fails to restrict request-header length when the Protocols configuration includes h2 or h2c. A remote attacker can send crafted CONTINUATION frames in an HTTP/2 request to drive unbounded memory consumption. This matters because it is a network-reachable denial of service against a widely deployed web server, and the affected versions are explicitly stated in the record.
Impact
An unauthenticated remote attacker can exhaust server memory, degrading or halting HTTP service for legitimate users. The CVSS vector shows availability impact only, with no confidentiality or integrity loss.
Attack surface
Reachable over the network via HTTP/2 (h2 or h2c) when enabled in the Protocols configuration; no authentication or user interaction is required per the CVSS vector AV:N/AC:L/PR:N/UI:N. Servers not configured for h2 or h2c are not exposed through this path.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.7907 probability, 0.99577 percentile) and a public exploit reference exists (Packet Storm memory exhaustion writeup), indicating meaningful real-world exploitation likelihood. No ransomware group usage is documented in the record.
What to do
- Upgrade Apache HTTP Server to a version after 2.4.23 that includes the fix (patch commit 29c63b786ae028d82405421585e91283c8fa0da3); apply vendor errata such as Red Hat RHSA-2017:1161/1413/1414/1415, Gentoo GLSA 201701-36, or NetApp NTAP-20180423-0001 as applicable.
- If HTTP/2 is not required, remove h2 and h2c from the Protocols directive to eliminate the attack path.
- If HTTP/2 must remain enabled, apply request-header size limits at the reverse proxy or load balancer in front of the server.
- Monitor and cap per-connection memory usage, and restart or throttle connections exhibiting abnormal CONTINUATION frame volume.
Detection
- Alert on HTTP/2 connections sending unusually large numbers of CONTINUATION frames or oversized header blocks.
- Monitor Apache process memory growth correlated with HTTP/2 traffic spikes.
- Track server errors and restarts consistent with memory exhaustion on hosts running affected versions with h2/h2c enabled.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2016-8740 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-8740), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
