Vulnerability record · CVE-2017-7659 · published 26 July 2017
CVE-2017-7659: Apache HTTP Server mod_http2 NULL pointer dereference crash
Apache · Http Server
A maliciously constructed HTTP/2 request can cause mod_http2 in Apache HTTP Server 2.4.24 and 2.4.25 to dereference a NULL pointer and crash the server process. The flaw is a denial-of-service condition in the HTTP/2 protocol handling module, and it matters because a single crafted request can take down the web server process.
Description
A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityCVSS 3.0 score is 7.5 (HIGH) for remote unauthenticated availability impact, and EPSS is very high at 0.53939, though KEV does not list it.
What it is
A maliciously constructed HTTP/2 request can cause mod_http2 in Apache HTTP Server 2.4.24 and 2.4.25 to dereference a NULL pointer and crash the server process. The flaw is a denial-of-service condition in the HTTP/2 protocol handling module, and it matters because a single crafted request can take down the web server process.
Impact
An attacker can crash the Apache HTTP Server process, causing a denial of service for all users served by that process. No data confidentiality or integrity impact is described; the effect is availability loss.
Attack surface
The flaw is reachable remotely over the network via HTTP/2 requests to a server running the affected mod_http2 versions. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
CISA KEV does not list this CVE, and no ransomware group usage is documented. EPSS is high (0.53939, 98.951 percentile), indicating a meaningful likelihood of exploitation activity, but the record does not confirm public exploit code or in-the-wild exploitation.
What to do
- Upgrade Apache HTTP Server to a version later than 2.4.25 that contains the mod_http2 fix, or apply the vendor patch referenced in Apache advisories.
- If immediate upgrade is not possible, disable mod_http2 or disable HTTP/2 support on affected servers.
- Apply distribution vendor updates (Debian DSA-3896, Red Hat RHSA-2017:2483, Gentoo GLSA 201710-32) where applicable.
- Monitor and rate-limit HTTP/2 traffic to reduce the chance of a single crafted request reaching the server.
- Review downstream product advisories (NetApp, Apple, HPE, Tenable) for bundled Apache versions that may still be affected.
Detection
- Monitor Apache error logs for crashes, segfaults, or abnormal process termination correlated with HTTP/2 requests.
- Use process monitoring to alert on unexpected httpd process restarts or worker crashes.
- Inspect HTTP/2 request patterns for malformed or unusual frames that precede server crashes.
- Track server availability metrics for sudden drops consistent with a single-request denial of service.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-7659 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-7659), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
