Description
Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.
References (29)
... and 9 more
Scores
CVSS v3
7.5
EPSS
0.7628
EPSS Percentile
98.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-444
Status
published
Products (50)
apache/http_server
2.4.20 - 2.4.46
canonical/ubuntu_linux
16.04
canonical/ubuntu_linux
18.04
canonical/ubuntu_linux
20.04
debian/debian_linux
10.0
fedoraproject/fedora
31
fedoraproject/fedora
32
opensuse/leap
15.1
opensuse/leap
15.2
oracle/communications_element_manager
8.2.0 - 8.2.2
... and 40 more
Published
Aug 07, 2020
Tracked Since
Feb 18, 2026