Vulnerability record · CVE-2024-27316 · published 4 April 2024
CVE-2024-27316: Apache HTTP Server HTTP/2 header flood causes memory exhaustion
Apache · Http Server
Apache HTTP Server buffers incoming HTTP/2 headers that exceed the configured limit in nghttp2 so it can return an HTTP 413 response. If the client keeps sending headers instead of stopping, that buffer grows without bound and exhausts server memory. The flaw is an unbounded allocation in a network-facing component, so it matters for availability of any exposed HTTP/2 endpoint.
Description
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityNetwork-reachable unauthenticated memory exhaustion with a 7.5 CVSS score and very high EPSS, though no KEV listing or confirmed in-the-wild exploitation is recorded.
What it is
Apache HTTP Server buffers incoming HTTP/2 headers that exceed the configured limit in nghttp2 so it can return an HTTP 413 response. If the client keeps sending headers instead of stopping, that buffer grows without bound and exhausts server memory. The flaw is an unbounded allocation in a network-facing component, so it matters for availability of any exposed HTTP/2 endpoint.
Impact
An unauthenticated remote attacker can drive memory consumption until the server becomes unresponsive or crashes, denying service to legitimate users. There is no data confidentiality or integrity impact; the effect is availability loss.
Attack surface
Reachable over the network via HTTP/2 requests to the affected server; the CVSS vector shows no privileges and no user interaction required. Any client able to open an HTTP/2 connection and keep sending headers can trigger it.
Exploitation
Not listed in CISA KEV and no ransomware association is recorded, but EPSS is very high (0.913 probability, 99.8th percentile), indicating strong predicted exploitation activity. Reference tags are product advisories and mailing lists, with no public exploit tag in the record.
What to do
- Apply the vendor HTTP/2 fix from the Apache HTTP Server security page and upgrade to a patched release.
- Update downstream packages (Fedora, Debian LTS, NetApp ONTAP, Apple) per their advisories.
- If patching is delayed, disable HTTP/2 or restrict it to trusted clients.
- Cap concurrent HTTP/2 connections and header volume at the reverse proxy or load balancer.
- Monitor server memory and restart or shed load before exhaustion during suspected floods.
Detection
- Alert on sustained growth in Apache worker memory correlated with HTTP/2 traffic.
- Look for clients sending unusually large or repeated header blocks, especially after a 413 response.
- Track spikes in HTTP/2 connections or 413 responses per source IP.
- Watch for OOM-killer events or process restarts on HTTP/2 front ends.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2024-27316 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-27316), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
