Critical Vulnerability in Apache2: Cache-Digest Header Exploit

apache2 Updated 02 Oct 2025

Summary

07/08/2020

Disclosed on

N/A

Severity

Yes i

Fix available

High

Severity

7.5

CVSS Score

ALPINE-CVE-2020-9490: Apache HTTP Server versions 2.4.20 to 2.4.43. Affects apache2 versions < 2.4.46-r0. Fixed in 2.4.46-r0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache HTTP Server, commonly referred to as Apache2, is a widely used open-source web server software that enables the hosting of websites and applications. It is known for its flexibility, power, and robust feature set, including support for various protocols and modules. However, certain versions of Apache2 are vulnerable to a specific issue related to the handling of the 'Cache-Digest' header in HTTP/2 requests, which can lead to server crashes.

Vulnerability Detail

The vulnerability, identified as CVE-2020-9490, affects Apache HTTP Server versions 2.4.20 to 2.4.43. It arises from a flaw in how the server processes a specially crafted value for the 'Cache-Digest' header in HTTP/2 requests. When the server attempts to HTTP/2 PUSH a resource after receiving such a request, it can crash, leading to potential denial of service. This vulnerability has a CVSS score of 7.5, indicating a high severity level.

How To Fix

Minimum fixed version

2.4.46-r0

This is the first release that contains the fix.

sudo apk add --upgrade apache2

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a temporary workaround, you can mitigate the impact of this vulnerability by disabling the HTTP/2 push feature. This can be done by adding the following directive to your Apache configuration: 'H2Push off'. This will prevent the server from attempting to push resources, thus avoiding the crash.

Conclusion

The CVE-2020-9490 vulnerability in Apache HTTP Server poses a significant risk due to its potential to crash the server under specific conditions. It is crucial for users to update to the patched version or implement the recommended workaround to ensure the stability and security of their web applications.

See every vulnerability recorded for apache2 →