CVE-2020-9490: Apache HTTP Server HTTP/2 Cache-Digest header crash

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 7.5 with network reachability, no authentication, and a very high EPSS score make this a serious denial-of-service risk for exposed HTTP/2 servers.

What it is

Apache HTTP Server versions 2.4.20 through 2.4.43 crash when a specially crafted Cache-Digest header is sent in an HTTP/2 request and the server subsequently attempts an HTTP/2 PUSH. The flaw is a denial-of-service condition in mod_http2, and the vendor notes that disabling HTTP/2 push with "H2Push off" mitigates it on unpatched servers.

Impact

An unauthenticated remote attacker can crash the affected Apache HTTP Server process, causing a denial of service for hosted sites and services.

Attack surface

Reachable over the network via HTTP/2 requests; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The server must have HTTP/2 enabled and HTTP/2 PUSH active for the crash to occur.

Exploitation

Not listed in CISA KEV and no ransomware use is documented; EPSS is very high (0.88844, 99.768th percentile), and references include a Packet Storm entry describing mod_http2 memory corruption, but the record does not confirm in-the-wild exploitation.

What to do

• Upgrade Apache HTTP Server to a version later than 2.4.43 that contains the fix.
• If immediate patching is not possible, set "H2Push off" in the server configuration to disable HTTP/2 PUSH.
• Consider disabling HTTP/2 entirely on internet-facing servers until the upgrade is applied.
• Track vendor advisories from Apache, Debian, Ubuntu, Red Hat, Fedora, openSUSE and Oracle for updated packages.
• Verify the running httpd version and loaded mod_http2 module after remediation.

Detection

• Monitor httpd error and crash logs for segmentation faults or abnormal child process exits tied to mod_http2.
• Inspect HTTP/2 traffic for requests containing a Cache-Digest header, especially unusual or malformed values.
• Alert on repeated HTTP/2 PUSH activity or server restarts following HTTP/2 requests.
• Use process monitoring to detect unexpected httpd worker termination and correlate with inbound HTTP/2 sessions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.