Executive brief
Apache HTTP Server is a widely used web server for hosting websites and applications. A vulnerability in its core HTTP processing module allows an attacker to send specially crafted requests that force the server to attempt an excessively large memory allocation. This can lead to a denial-of-service condition, potentially crashing the server or making it unresponsive to legitimate users.
Technical details
A vulnerability classified as CWE-789 (Memory Allocation with Excessive Size Value) exists in the mod_http module of Apache HTTP Server. The flaw occurs when the server processes malicious HTTP requests that specify an excessive size for memory allocation, leading to resource exhaustion or a crash. This is a remote, unauthenticated attack vector. The issue affects versions 2.4.17 through 2.4.67 and is addressed in version 2.4.68.
Affected products
- Apache HTTP Server 2.4.17 through 2.4.67
Timeline
- 2026-06-08: advisory: Initial advisory published by Apache and NVD
- 2026-06-08: patched: Fixed in Apache HTTP Server version 2.4.68