QID 150863

The Apache HTTP Server, colloquially called Apache, is a free and open-source cross-platform web server software.

Affected versions of Apache HTTP Server has multiple vulnerabilities:

HTTP response splitting (CVE-2023-38709): Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses.

HTTP Response Splitting in multiple modules (CVE-2024-24795): HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.

HTTP/2 DoS by memory exhaustion on endless continuation frames (CVE-2024-27316): HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

Affected Versions:
Apache HTTP Server version from 2.4.0 to 2.4.58

QID Detection Logic (Unauthenticated):
This QID sends a HTTP GET request and checks the response headers to confirm if the host is running vulnerable version of Apache HTTP Server.

Successful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.