CVE-2016-4979

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27.

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. This acceptance of different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers.

Apache HTTP Server through 2.4.23 does not protect applications from untrusted client data in the HTTP_PROXY environment variable, allowing remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request.

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served but not directly reachable, leading to code execution or source code disclosure.

Null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.

Faulty input validation in the core of Apache HTTP Server through 2.4.58 allows malicious or exploitable backend/content generators to split HTTP responses, leading to HTTP response splitting attacks.

HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.

A partial fix for CVE-2024-39884 in Apache HTTP Server 2.4.61 ignores some legacy content-type based configurations like AddType. Under certain circumstances with indirect file requests, this can lead to source code disclosure of local content.

Serving WebSocket protocol upgrades over an HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.