« Back to list

CVE-2017-9798

Status: ModifiedHigh (7.5)—💥 Exploit

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

💥 Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

Affected technologies (2)

Apache — Http ServerDebian — Debian Linux

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2017-9798",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache HTTP Server",
          "versions": [
            {
              "status": "affected",
              "version": "Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-09-18T15:29:00.307",
  "references": [
    {
      "url": "http://openwall.com/lists/oss-security/2017/09/18/2",
      "tags": [
        "Mailing List",
        "VDB Entry"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.debian.org/security/2017/dsa-3980",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/100872",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/105598",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1039387",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:2882",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:2972",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3018",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3113",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3114",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3193",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3194",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3195",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3239",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3240",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3475",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3476",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3477",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html",
      "tags": [
        "Exploit",
        "Patch",
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch",
      "tags": [
        "Exploit",
        "Patch",
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://github.com/apache/httpd/commit/4cc27823899e070268b906ca677ee838d07cf67a",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://github.com/hannob/optionsbleed",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://security-tracker.debian.org/tracker/CVE-2017-9798",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/201710-32",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20180601-0003/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://support.apple.com/HT208331",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/42745/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://www.tenable.com/security/tns-2019-09",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2017/09/18/2",
      "tags": [
        "Mailing List",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2024/Sep/22",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2017/dsa-3980",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/100872",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/105598",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1039387",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:2882",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:2972",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3018",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3113",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3114",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3193",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3194",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3195",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3239",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3240",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3475",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3476",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3477",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html",
      "tags": [
        "Exploit",
        "Patch",
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch",
      "tags": [
        "Exploit",
        "Patch",
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/apache/httpd/commit/4cc27823899e070268b906ca677ee838d07cf67a",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/hannob/optionsbleed",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security-tracker.debian.org/tracker/CVE-2017-9798",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201710-32",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20180601-0003/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.apple.com/HT208331",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/42745/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tenable.com/security/tns-2019-09",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c."
    },
    {
      "lang": "es",
      "value": "Apache httpd permite que atacantes remotos lean datos secretos de la memoria de proceso si la directiva Limit se puede establecer en un archivo .htaccess del usuario o si existen ciertos errores de configuración en httpd.conf. Esto también se conoce como Optionsbleed. Esta vulnerabilidad afecta a Apache HTTP Server hasta la versión 2.2.34 y a las versiones 2.4.x hasta la 2.4.27. El atacante envía una petición HTTP OPTIONS sin autenticar cuando intenta leer datos secretos. Este es un problema de uso de memoria previamente liberada y, por lo tanto, los datos secretos no siempre se envían y los datos específicos dependen de muchos factores, entre los que se encuentra la configuración. La explotación con .htaccess puede bloquearse con un parche en la función ap_limit_section en server/core.c."
    }
  ],
  "lastModified": "2026-06-17T01:28:56.200",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE75C79F-7F36-41C1-BF03-97416A06D81F",
              "versionEndIncluding": "2.2.34"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDC40E89-2D57-4988-913E-024BFB56B367"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6FCD3C8C-9BF8-4F30-981A-593EEAEB9EDD"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "046487A3-752B-4D0F-8984-96486B828EAB"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89D2E052-51CD-4B57-A8B8-FAE51988D654"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EAA27058-BACF-4F94-8E3C-7D38EC302EC1"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8FEAB0DF-04A9-4F99-8666-0BADC5D642B8"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7D924D1-8A36-4C43-9E56-52814F9A6350"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39CDFECC-E26D-47E0-976F-6629040B3764"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E3ECBCB1-0675-41F5-857B-438F36925F63"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB6CBFBF-74F6-42AF-BC79-AA53EA75F00B"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8717A96B-9DB5-48D6-A2CF-A5E2B26AF3F3"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1F45B27-504B-4202-87B8-BD3B094003F1"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F2FB2B98-DFD2-420A-8A7F-9B288651242F"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B803D25B-0A19-4569-BA05-09D58F33917C"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.23:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8510442C-212F-4013-85FA-E0AB59F6F2C6"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.25:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB5673AB-53BB-40B2-83A7-8B82B2D0EBB8"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.26:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FBB3ED63-45CA-44AB-973C-9AD2569AD800"
            },
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.27:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF30AD98-9CBA-456E-A827-79FCEDEB30A1"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}