CVE-2017-9798: Apache httpd use-after-free in Limit handling leaks process memory

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 3.1 base score is 7.5 (HIGH) with network reachability, no privileges or user interaction, and high confidentiality impact, and EPSS is near the top percentile.

What it is

Apache httpd has a use-after-free in the ap_limit_section function that can be triggered when the Limit directive is set in a user's .htaccess file or when httpd.conf is misconfigured. A remote unauthenticated attacker can send an OPTIONS request and read secret data from process memory, a flaw known as Optionsbleed. It affects Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27.

Impact

An attacker can read fragments of server process memory, potentially exposing secrets such as credentials, session data or other sensitive values. Because the leak is a use-after-free, data is not always returned and the specific contents depend on configuration and runtime state.

Attack surface

Reachable over the network via an unauthenticated HTTP OPTIONS request; no authentication or user interaction is required per the CVSS vector. Exploitation via .htaccess requires that file to be writable by a user and the Limit directive to be settable there, or a specific httpd.conf misconfiguration.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.94999 probability, 0.99858 percentile) and references include Exploit and Technical Description tags, indicating public exploit detail exists. No ransomware groups are documented as using it.

What to do

• Upgrade Apache HTTP Server to a version containing the fix for ap_limit_section in server/core.c (2.2.35 or later, 2.4.28 or later).
• Apply vendor patches or backports from Debian, Red Hat, Oracle or the upstream commit referenced in the advisory.
• Disable or restrict the Limit directive in .htaccess files, and review httpd.conf for misconfigurations that allow it.
• Where feasible, block or filter the OPTIONS HTTP method at the perimeter or reverse proxy.
• Audit .htaccess write permissions so untrusted users cannot set Limit directives.

Detection

• Monitor web server logs for unusual or repeated OPTIONS requests, especially from single sources.
• Inspect HTTP responses to OPTIONS requests for unexpected or anomalous content that may indicate memory leakage.
• Review .htaccess files and httpd.conf for Limit directive usage and unexpected changes.
• Track Apache httpd versions in inventory and alert on hosts still running 2.2.x through 2.2.34 or 2.4.x through 2.4.27.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.