CVE-2024-27316

Name	CVE-2024-27316
Description	HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3818-1, DSA-5662-1, ELA-1129-1
Debian Bugs	1068412

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
apache2 (PTS)	jessie, jessie (lts)	2.4.10-10+deb8u29	fixed
	stretch (security)	2.4.25-3+deb9u13	vulnerable
	stretch (lts), stretch	2.4.25-3+deb9u19	fixed
	buster, buster (lts)	2.4.59-1~deb10u4	fixed
	buster (security)	2.4.59-1~deb10u1	fixed
	bullseye	2.4.62-1~deb11u1	fixed
	bullseye (security)	2.4.62-1~deb11u2	fixed
	bookworm (security), bookworm	2.4.62-1~deb12u2	fixed
	sid, trixie	2.4.62-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
apache2	source	jessie	(not affected)
apache2	source	stretch	2.4.25-3+deb9u17	ELA-1129-1
apache2	source	buster	2.4.59-1~deb10u1	DLA-3818-1
apache2	source	bullseye	2.4.59-1~deb11u1	DSA-5662-1
apache2	source	bookworm	2.4.59-1~deb12u1	DSA-5662-1
apache2	source	(unstable)	2.4.59-1		1068412

Notes

https://www.kb.cert.org/vuls/id/421644
https://www.openwall.com/lists/oss-security/2024/04/04/4
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2024-27316
https://github.com/apache/httpd/commit/0d73970ec161300a55b630f71bbf72b5c41f28b9
[jessie] - apache2 <not-affected> (http2 support introduced later)
Need for backport hard to backport https://github.com/apache/httpd/commit/db462008f57927ce45b2f75645695325d48c30c9