CVE-2016-2161

HIGH 7.5CVE-2016-2161 · Published 27/07/2017 · updated 17/06/2026

In short

CVE-2016-2161 is a HIGH (CVSS 7.5) vulnerability affecting http server (apache).
Chance of exploitation in the next 30 days (EPSS): 21.0%, higher than 97.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
http server apache	`= 2.4.0= 2.4.1= 2.4.10= 2.4.12= 2.4.14= 2.4.16= 2.4.19= 2.4.2= 2.4.20= 2.4.21= 2.4.22= 2.4.23= 2.4.3= 2.4.6= 2.4.7= 2.4.8= 2.4.9`	No fix yet

Description

In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests.

References

rhn.redhat.com/errata/RHSA-2017-1415.html
debian.org/security/2017/dsa-3796
securityfocus.com/bid/95076 · Third Party Advisory
securitytracker.com/id/1037508 · Third Party Advisory
access.redhat.com/errata/RHSA-2017:0906
access.redhat.com/errata/RHSA-2017:1161
access.redhat.com/errata/RHSA-2017:1413
access.redhat.com/errata/RHSA-2017:1414
h20566.www2.hpe.com/hpsc/doc/public/display · Third Party Advisory
httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E

More vulnerabilities in http server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free