CVE-2017-9788: Apache httpd mod_auth_digest uninitialized memory leak and DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCritical CVSS 9.1 and very high EPSS with unauthenticated network reachability, though no known in-the-wild exploitation is documented.

What it is

In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, mod_auth_digest fails to initialize or reset the value placeholder in Digest-type [Proxy-]Authorization headers before or between successive key=value assignments. A request supplying an initial key with no '=' assignment can cause the server to reflect stale uninitialized pool memory from a prior request, leaking potentially confidential data, and in other cases triggers a segfault causing denial of service.

Impact

An attacker can read residual memory contents from previous requests, potentially exposing confidential information, and can crash the httpd process to cause denial of service.

Attack surface

Reachable over the network via HTTP requests to a server running mod_auth_digest; the CVSS vector indicates no privileges or user interaction are required, though the Digest authentication module must be in use.

Exploitation

Not listed in CISA KEV and no ransomware usage documented; EPSS is high at roughly 0.568 (99th percentile), and references are advisories and patches with no public exploit tags.

What to do

• Upgrade Apache httpd to 2.2.34 or 2.4.27 or later, or apply the vendor patch for your distribution.
• Apply the referenced Red Hat, Debian, Oracle and other vendor errata if you cannot upgrade immediately.
• Disable mod_auth_digest if Digest authentication is not required.
• Restrict network exposure of affected httpd instances to trusted clients where feasible.

Detection

• Monitor httpd logs for segfaults or abnormal process crashes tied to requests with Digest Authorization headers.
• Inspect requests containing Digest Authorization headers with keys lacking '=' assignments, which are anomalous for legitimate clients.
• Watch for repeated or malformed Digest authentication attempts from single sources that could indicate probing.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.