Important: httpd:2.4/mod_http2 security update
Summary
ALSA-2024:1786: Important: httpd:2.4/mod_http2 security update. Affects httpd versions < 2.4.37-62.module_el8.9.0+3646+acd210d0. Fixed in 2.4.37-62.module_el8.9.0+3646+acd210d0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. It is widely used for hosting websites and applications.
Vulnerability Detail
The vulnerability (CVE-2024-27316) affects the mod_http2 module in the Apache HTTP Server. It allows an attacker to cause a Denial of Service (DoS) by sending specially crafted CONTINUATION frames. This vulnerability can be exploited remotely and may lead to service disruption or unavailability.
How To Fix
Minimum fixed version
2.4.37-62.module_el8.9.0+3646+acd210d0
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the security update to mitigate the risk.
Conclusion
It is crucial to update the httpd package to the recommended version or later to protect against this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for httpd →
FAQ
The vulnerability allows an attacker to cause a DoS by sending specially crafted CONTINUATION frames. This can result in service disruption or unavailability.
Yes, this vulnerability can be exploited remotely.
No, there is no known workaround. It is necessary to apply the security update.
The vulnerability affects httpd versions prior to 2.4.37-62.module_el8.9.0+3646+acd210d0.
You can find more information about this vulnerability on the CVE page: CVE-2024-27316.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
