CVE-2020-9490

httpd: Push diary crash on specifically crafted HTTP/2 header

Loading…

Severity

Important

Red Hat Product Security

7.5

CVSS 3.1

Review impact separately from score.

Published · August 7, 2020

Updated · August 4, 2026

Description

A flaw was found in Apache httpd in versions prior to 2.4.46. A specially crafted Cache-Digest header triggers negative argument to memmove() that could lead to a crash and denial of service. The highest threat from this vulnerability is to system availability.

Statement

As per upstream this flaw only affects Apache HTTP Server versions 2.4.20 to 2.4.43. Therefore only httpd packages shipped with Red Hat Enterprise Linux 8 are affected.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability.

CVSS / CWE

CVSS 3.1 · 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-400 · Uncontrolled Resource Consumption