According to its banner, the version of Apache running on the remote host is either 2.4.17 or 2.4.18. It is, therefore, affected by a denial of service vulnerability in the module for the HTTP/2 protocol due to thread starvation.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache HTTP Server 2.4 installed on the remote host is prior to 2.4.23. It is, therefore, affected by the following vulnerabilities : 

 - A flaw exists within the 'read_request_line()' function located in 'server/protocol.c'. The issue is triggered when handling invalid 'CONNECT' requests with a custom status 'code 400 error' page using server side includes. With a specially crafted request, a remote attacker can cause a crash.
 - A flaw can be triggered when a stream's flow control windows are manipulated. This may allow an authenticated remote attacker to block server threads for an extended period of time, allowing them to exhaust worker threads and prevent the processing of streams. (CVE-2016-1546) - A flaw is triggered when an experimental module for the 'HTTP/2' protocol is used to access a resource. This may result in X.509 certificates not being properly validated, allowing an unauthorized user to disclose potentially sensitive information in resources that should require valid certificates. (CVE-2016-4979)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-1638:01 advisory.

    The Apache HTTP Server is a powerful, efficient, and extensible     web server.
    Security issues fixed with this release:
    CVE-2016-0736
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-1546     The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled,     does not limit the number of simultaneous stream workers for a single     HTTP/2 connection, which allows remote attackers to cause a denial of     service (stream-processing outage) via modified flow-control windows.
    CVE-2016-2161
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-8740     The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23,     when the Protocols configuration includes h2 or h2c, does not restrict     request-header length, which allows remote attackers to cause a denial     of service (memory consumption) via crafted CONTINUATION frames in an     HTTP/2 request.
    CVE-2016-8743
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-1637:01 advisory.

    The Apache HTTP Server is a powerful, efficient, and extensible     web server.
    Security issues fixed with this release:
    CVE-2016-0736
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-1546     The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled,     does not limit the number of simultaneous stream workers for a single     HTTP/2 connection, which allows remote attackers to cause a denial of     service (stream-processing outage) via modified flow-control windows.
    CVE-2016-2161
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-8740     The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23,     when the Protocols configuration includes h2 or h2c, does not restrict     request-header length, which allows remote attackers to cause a denial     of service (memory consumption) via crafted CONTINUATION frames in an     HTTP/2 request.
    CVE-2016-8743
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201610-02 (Apache: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache HTTP Server.
      Please review the CVE identifiers referenced below for details.
  Impact :

    Remote attackers could bypass intended access restrictions, conduct HTTP       request smuggling attacks, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

An update of [cracklib,libevent,libgcrypt,httpd,glibc] packages for PhotonOS has been released.

An update of the httpd package has been released.

According to its banner, the version of Apache running on the remote host is either 2.4.17 or 2.4.18.

A denial of service (DoS) vulnerability exists in server threads due to a lengthy thread-block time. An unauthenticated, remote attacker can exploit this issue, to block server threads, and causing the application to stop responding.

ID	Name	Product	Family	Published	Updated	Severity
98917	Apache 2.4.17 / 2.4.18 mod_http2 Denial of Service	Web App Scanning	Component Vulnerability	1/31/2019	3/14/2023	medium
9394	Apache HTTP Server 2.4.x < 2.4.23 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	7/15/2016	3/6/2019	medium
291587	MiracleLinux 7 : httpd24-httpd-2.4.25-9.el7 (AXSA:2017-1638:01)	Nessus	Miracle Linux Local Security Checks	1/19/2026	1/19/2026	high
289502	MiracleLinux 4 : httpd24-httpd-2.4.25-9.AXS4 (AXSA:2017-1637:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	high
93903	GLSA-201610-02 : Apache: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	10/7/2016	1/22/2026	high
111862	Photon OS 1.0: Cracklib / Glibc / Httpd / Libevent / Libgcrypt PHSA-2017-0013 (deprecated)	Nessus	PhotonOS Local Security Checks	8/17/2018	2/7/2019	critical
121683	Photon OS 1.0: Httpd PHSA-2017-0013	Nessus	PhotonOS Local Security Checks	2/7/2019	3/20/2025	medium
122059	Apache 2.4.17 / 2.4.18 DoS	Nessus	Web Servers	2/8/2019	3/20/2025	medium

Detections

Analytics

Plugins Search

medium

medium

high

high

high

critical

medium

medium