CVE-2024-27316 Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Disclosed for Apache HTTP Server Vulnerabilities Four vulnerabilities affecting the Apache HTTP Server have been disclosed, including source code disclosures and denial-of-service (DoS) issues. The vulnerabilities, identified as CVE-2024-39884, CVE-2024-40725, CVE-2024-27316, and CVE-2024-36387, impact configurations using AddType and HTTP/2 features. Organizations using affected versions of Apache HTTP Server should assess their systems for these vulnerabilities. 9 sources 65

Extracted Entities

Attack Types (1)

Denial of Service

CVEs (1)

MITRE ATT&CK (1)

T1499 - Endpoint Denial of Service

Platforms (1)

Apache HTTP Server