CVE-2016-1546: Medium severity Apache HTTP Server vulnerability
A vulnerability was found in httpd. By manipulating the flow control windows on streams, a client was able to block server threads for long times, causing starvation of worker threads. Connections could still be opened, but no streams where processed for these. This issue affected HTTP/2 support in 2.4.17 and 2.4.18.
External references:
http://httpd.apache.org/security/vulnerabilities24.html
Other sources
The Apache HTTP Server 2.4.17 and 2.4.18, when modhttp2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service (stream-processing outage) via modified flow-control windows.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.20 - Upgrade
Upgrade
httpdto a version that resolves this vulnerability.Fixed in 2.4.17 - Upgrade
Upgrade
httpdto a version that resolves this vulnerability.Fixed in 2.4.18
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1546?
CVE-2016-1546 has a medium severity rating as it can lead to a denial of service due to mismanaged stream workers.
How do I fix CVE-2016-1546?
To fix CVE-2016-1546, you should upgrade the Apache HTTP Server to version 2.4.20 or later.
Which versions of Apache HTTP Server are affected by CVE-2016-1546?
CVE-2016-1546 affects Apache HTTP Server versions 2.4.17 and 2.4.18.
What type of attack does CVE-2016-1546 enable?
CVE-2016-1546 enables remote attackers to create denial of service conditions by exploiting stream-processing outages.
Is mod_http2 a prerequisite for CVE-2016-1546?
Yes, the vulnerability CVE-2016-1546 exists only when mod_http2 is enabled in the Apache HTTP Server.