Loading vulnerability…
Buffer over-read in Apache HTTP Server ap_find_token()
CVE-2017-7668 is a buffer over-read in Apache HTTP Server's ap_find_token() function. Strict HTTP parsing changes introduced in httpd 2.2.32 and 2.4.24 created a token-list parsing bug that allows the function to search beyond the end of its input string. A maliciously crafted sequence of HTTP request headers can trigger a segmentation fault or cause the function to return an incorrect value. Affected releases include 2.2.32, 2.4.24, and 2.4.25.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote exploitation can crash an httpd child process, causing denial of service. The flaw can also produce incorrect token-parsing results. Information disclosure, code execution, and privilege escalation are not established for this vulnerability.
If you can’t patch tonight, do this now.
Until patched, limit network exposure and restrict untrusted access to affected HTTP Server instances using network access controls. Monitor for malformed HTTP headers and child-process crashes. These measures reduce exposure but do not correct the parsing flaw.
Patch, then assume compromise.
Upgrade to Apache HTTP Server 2.4.26 or later containing the fix. The historical 2.2-branch fix is included in 2.2.34; deployments still using that end-of-life branch should migrate to a supported release. Distribution packages may contain backported fixes: Debian fixed versions include 2.4.10-10+deb8u9 for Debian 8, 2.4.25-3+deb9u1 for Debian 9, and 2.4.25-4 for unstable. For Red Hat deployments, apply the appropriate updates from RHSA-2017:2479, RHSA-2017:2483, RHSA-2017:3193, or RHSA-2017:3194. Verify vendor patch status rather than relying solely on upstream version strings.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.