CVE-2020-9490

HIGH

Apache HTTP Server < 2.4.46 - HTTP Request Smuggling

Title source: rule

Description

Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.

References (29)

... and 9 more

Scores

CVSS v3 7.5
EPSS 0.7628
EPSS Percentile 98.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Classification

CWE
CWE-444
Status published

Affected Products (50)

apache/http_server < 2.4.46
oracle/communications_element_manager < 8.2.2
oracle/communications_session_report_manager < 8.2.2
oracle/communications_session_route_manager < 8.2.2
oracle/enterprise_manager_ops_center
oracle/hyperion_infrastructure_technology
oracle/instantis_enterprisetrack
oracle/instantis_enterprisetrack
oracle/instantis_enterprisetrack
oracle/zfs_storage_appliance_kit
opensuse/leap
opensuse/leap
debian/debian_linux
fedoraproject/fedora
fedoraproject/fedora
... and 35 more

Timeline

Published Aug 07, 2020
Tracked Since Feb 18, 2026