CVE-2017-9789

Vulnerability

Apache HTTP Server version 2.4.26 contains a use-after-free vulnerability in its HTTP/2 handling code. Under high stress conditions, when many connections are being closed simultaneously, the server may access memory after it has been freed, leading to potentially erratic behavior [1][2].

Exploitation

An attacker capable of establishing multiple HTTP/2 connections and triggering rapid closure of those connections can induce the race condition. No specific authentication or special network position beyond the ability to send HTTP/2 requests is required. The exploit requires the server to be under sufficient load to trigger the race window [2][3].

Impact

Successful exploitation can lead to unpredictable behavior, including denial of service or potential memory corruption. The official description notes "potentially erratic behaviour," which may include crashes or information exposure. The vulnerability is rated High with a CVSS v3 base score of 7.5 [1][2].

Mitigation

A fix is included in Apache HTTP Server version 2.4.27 and later. Users are advised to update to the latest stable release immediately. For example, Gentoo users should upgrade to www-servers/apache-2.4.27-r1 or later [3]. No workaround is known, as the issue resides in the core HTTP/2 module [2][3].