CVE-2024-27316

Medium

Published: —Translated: 27/07/2026(UTC)NVD NIST

Summary

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

Risk Assessment

An attacker can cause memory exhaustion on the server, leading to denial of service (DoS) and degraded server performance.

Recommendation

Upgrade Apache HTTP Server to a version containing a fix for this vulnerability or limit the number of allowed HTTP/2 headers.

Original NVD description (English source)

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.