CVE-2016-8743 in the critical feed json
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response l…
published 2017-07-27 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-9577
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 13.3%
- EPSS 13.3% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.
Patch / fix
- apache2 Debian 14, Debian 13, Debian 12 2.4.25-1
debian advisories DEBIAN-CVE-2016-8743
- apache2 Ubuntu 14.04 LTS 2.4.7-1ubuntu4.15
- apache2 Ubuntu 16.04 LTS 2.4.18-2ubuntu3.2
ubuntu advisories UBUNTU-CVE-2016-8743
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- httpd24-httpd RHEL 2 SOFTWARE_COLLECTIONS 2.4.25-9.el6
- httpd24-httpd RHEL 2 SOFTWARE_COLLECTIONS 2.4.25-9.el7
- httpd24-mod_ssl RHEL 2 SOFTWARE_COLLECTIONS 1:2.4.25-9.el6
- httpd24-mod_ssl RHEL 2 SOFTWARE_COLLECTIONS 1:2.4.25-9.el7
- httpd24-mod_ldap RHEL 2 SOFTWARE_COLLECTIONS 2.4.25-9.el6
- httpd24-mod_ldap RHEL 2 SOFTWARE_COLLECTIONS 2.4.25-9.el7
- httpd24-httpd-tools RHEL 2 SOFTWARE_COLLECTIONS 2.4.25-9.el6
- httpd24-httpd-tools RHEL 2 SOFTWARE_COLLECTIONS 2.4.25-9.el7
red hat advisories RHSA-2017:1161RHSA-2017:1721RHSA-2017:1414RHSA-2017:1413RHSA-2017:0906
- apache2 SLES 12 SP3, SLES 12 SP2-BCL, SLE Software Development Kit 12 SP3 +5 more 2.4.23-29.24.1
- apache2 SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2, SLES 12 SP2 +1 more 2.4.23-21.1
- apache2 SLES for SAP 12 SP1, SLES 12 SP1, SLE Software Development Kit 12 SP1 2.4.16-19.1
- apache2 Studio Onsite 1.3, SLES for SAP 11 SP4, SLES 11 SP4 +1 more 2.2.12-69.1
- apache2 SLES for SAP 12 SP1, SLES 12 SP1-LTSS 2.4.16-20.19.1
suse advisories SUSE-SU-2018:2815-2SUSE-SU-2018:2815-1SUSE-SU-2018:2554-1SUSE-SU-2017:0797-1SUSE-SU-2017:0801-1SUSE-SU-2017:0729-1
- security.gentoo.org/glsa/201701-36 advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2016-8743 updated cvss 4.0
httpd: Apache HTTP Request Parsing Whitespace Defects
-
Red Hat Enterprise Linux 5 httpdaffected: no fix planned “Will not fix”
-
Red Hat JBoss Enterprise Application Platform 6 httpd22 httpd22affected: no fix available
-
Red Hat JBoss Enterprise Web Server 1 httpd Red Hat JBoss Enterprise Web Server 2 httpd22 httpd22affected: no fix planned “Will not fix”
-
Red Hat Enterprise Linux Client Optional (v. 7) httpd 2.4.6-45.el7_3.4, mod_ssl 2.4.6-45.el7_3.4, mod_ldap 2.4.6-45.el7_3.4, httpd-tools 2.4.6-45.el7_3.4, mod_session 2.4.6-45.el7_3.4, httpd-manual 2.4.6-45.el7_3.4, +1 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd 2.4.6-45.el7_3.4, mod_ssl 2.4.6-45.el7_3.4, mod_ldap 2.4.6-45.el7_3.4, httpd-tools 2.4.6-45.el7_3.4, mod_session 2.4.6-45.el7_3.4, httpd-manual 2.4.6-45.el7_3.4, +1 morefixed: vendor fix RHSA-2017:0906
-
Red Hat Enterprise Linux Desktop (v. 6) httpd 2.2.15-60.el6_9.4, httpd-tools 2.2.15-60.el6_9.4 Red Hat Enterprise Linux Desktop Optional (v. 6) mod_ssl 2.2.15-60.el6_9.4, httpd-manual 2.2.15-60.el6_9.4 Red Hat Enterprise Linux HPC Node (v. 6) httpd 2.2.15-60.el6_9.4, httpd-tools 2.2.15-60.el6_9.4 Red Hat Enterprise Linux HPC Node Optional (v. 6) mod_ssl 2.2.15-60.el6_9.4, httpd-manual 2.2.15-60.el6_9.4 Red Hat Enterprise Linux Server (v. 6) httpd 2.2.15-60.el6_9.4, mod_ssl 2.2.15-60.el6_9.4, httpd-tools 2.2.15-60.el6_9.4, httpd-manual 2.2.15-60.el6_9.4fixed: vendor fix RHSA-2017:1721
-
Red Hat Enterprise Linux Server (v. 7) httpd 2.4.6-45.el7_3.4, mod_ssl 2.4.6-45.el7_3.4, httpd-tools 2.4.6-45.el7_3.4, httpd-manual 2.4.6-45.el7_3.4 Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap 2.4.6-45.el7_3.4, mod_session 2.4.6-45.el7_3.4, mod_proxy_html 2.4.6-45.el7_3.4fixed: vendor fix RHSA-2017:0906
-
Red Hat Enterprise Linux Workstation (v. 6) httpd 2.2.15-60.el6_9.4, mod_ssl 2.2.15-60.el6_9.4, httpd-tools 2.2.15-60.el6_9.4, httpd-manual 2.2.15-60.el6_9.4fixed: vendor fix RHSA-2017:1721
-
Red Hat Enterprise Linux Workstation (v. 7) httpd 2.4.6-45.el7_3.4, mod_ssl 2.4.6-45.el7_3.4, httpd-tools 2.4.6-45.el7_3.4, httpd-manual 2.4.6-45.el7_3.4 Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap 2.4.6-45.el7_3.4, mod_session 2.4.6-45.el7_3.4, mod_proxy_html 2.4.6-45.el7_3.4fixed: vendor fix RHSA-2017:0906
show 5 moreshow fewer
-
Red Hat JBoss Core Servicesfixed: vendor fix RHSA-2017:1415
-
Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-httpd 2.4.23-120.jbcs.el6, jbcs-httpd24-openssl 1.0.2h-13.jbcs.el6, jbcs-httpd24-mod_ssl 2.4.23-120.jbcs.el6, jbcs-httpd24-mod_ldap 2.4.23-120.jbcs.el6, jbcs-httpd24-httpd-libs 2.4.23-120.jbcs.el6, jbcs-httpd24-httpd-tools 2.4.23-120.jbcs.el6, +7 morefixed: vendor fix RHSA-2017:1414
-
Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-httpd 2.4.23-120.jbcs.el7, jbcs-httpd24-openssl 1.0.2h-13.jbcs.el7, jbcs-httpd24-mod_ssl 2.4.23-120.jbcs.el7, jbcs-httpd24-mod_ldap 2.4.23-120.jbcs.el7, jbcs-httpd24-httpd-libs 2.4.23-120.jbcs.el7, jbcs-httpd24-httpd-tools 2.4.23-120.jbcs.el7, +7 morefixed: vendor fix RHSA-2017:1413
-
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-httpd 2.4.25-9.el6, httpd24-mod_ssl 2.4.25-9.el6, httpd24-mod_ldap 2.4.25-9.el6, httpd24-httpd-tools 2.4.25-9.el6, httpd24-mod_session 2.4.25-9.el6, httpd24-httpd-manual 2.4.25-9.el6, +1 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-httpd 2.4.25-9.el7, httpd24-mod_ssl 2.4.25-9.el7, httpd24-mod_ldap 2.4.25-9.el7, httpd24-httpd-tools 2.4.25-9.el7, httpd24-mod_session 2.4.25-9.el7, httpd24-httpd-manual 2.4.25-9.el7, +1 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) httpd24-httpd 2.4.25-9.el6, httpd24-mod_ssl 2.4.25-9.el6, httpd24-mod_ldap 2.4.25-9.el6, httpd24-httpd-tools 2.4.25-9.el6, httpd24-mod_session 2.4.25-9.el6, httpd24-httpd-manual 2.4.25-9.el6, +1 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) httpd24-httpd 2.4.25-9.el7, httpd24-mod_ssl 2.4.25-9.el7, httpd24-mod_ldap 2.4.25-9.el7, httpd24-httpd-tools 2.4.25-9.el7, httpd24-mod_session 2.4.25-9.el7, httpd24-httpd-manual 2.4.25-9.el7, +1 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-httpd 2.4.25-9.el6, httpd24-mod_ssl 2.4.25-9.el6, httpd24-mod_ldap 2.4.25-9.el6, httpd24-httpd-tools 2.4.25-9.el6, httpd24-mod_session 2.4.25-9.el6, httpd24-httpd-manual 2.4.25-9.el6, +1 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-httpd 2.4.25-9.el7, httpd24-mod_ssl 2.4.25-9.el7, httpd24-mod_ldap 2.4.25-9.el7, httpd24-httpd-tools 2.4.25-9.el7, httpd24-mod_session 2.4.25-9.el7, httpd24-httpd-manual 2.4.25-9.el7, +1 morefixed: vendor fix RHSA-2017:1161
-
Red Hat Directory Server 8 httpd Red Hat JBoss Enterprise Application Platform 5 httpd Red Hat JBoss Web Server 3 httpd24 httpd24not affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
13.25% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Affected products
- Apache Software Foundation Apache HTTP Server
Classification
- Technology feeds
References
-
security.gentoo.org
/glsa/201701-36
vendor-advisory, patch, third-party-advisory, vdb-entry
-
debian.org
/security/2017/dsa-3796
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2017:1721
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2017:1413
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2017:1161
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2017:1414
vendor-advisory, third-party-advisory
-
rhn.redhat.com
/errata/RHSA-2017-1415.html
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2017:0906
vendor-advisory, third-party-advisory
-
httpd.apache.org
/security/vulnerabilities_24.html#CVE-2016-8743
vendor-advisory
-
support.apple.com
/HT208221
third-party-advisory
-
securitytracker.com
/id/1037508
vdb-entry, broken-link, third-party-advisory
-
tenable.com
/security/tns-2017-04
third-party-advisory
-
h20566.www2.hpe.com
/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03753en_us
third-party-advisory
-
securityfocus.com
/bid/95077
vdb-entry, third-party-advisory
-
h20566.www2.hpe.com
/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us
third-party-advisory
-
security.netapp.com
/advisory/ntap-20180423-0001/
third-party-advisory
-
lists.apache.org
/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r94284b139540e5287ebdd3450682d3e3d187263dd6b75af8fa7d4890%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r4fe84db67fe9dc906c6185e58bbd9913f4356dd555a5c3db490694e5%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r09b8a39d1262adbab5528eea73df1b1f93e919bf004ed5a843d9cad1%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rfcb6c7b9e7ca727a7eeeb5f13f89488a03981cfa0e7c3125f18fa239%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E
mailing-list
Sources
- CVE List CVE-2016-8743
- NVD CVE-2016-8743
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.