Skip to content
Fencer Intel
high 7.5

CVE-2017-9798 in the critical feed json

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file,…

published 2017-09-18 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-18719

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
94.7%
EPSS 94.7% chance of exploitation in 30 days, percentile 99.8%
public exploits
2
Metasploit, Exploit-DB

Summary

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.

Patch / fix

  • apache2 Debian 14, Debian 13, Debian 12 2.4.27-6

debian advisories DEBIAN-CVE-2017-9798

  • apache2 Ubuntu 14.04 LTS 2.4.7-1ubuntu4.18
  • apache2 Ubuntu 16.04 LTS 2.4.18-2ubuntu3.5

ubuntu advisories UBUNTU-CVE-2017-9798

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • httpd RHEL 6 2.2.15-60.el6_9.6
  • mod_ssl RHEL 6 1:2.2.15-60.el6_9.6
  • httpd-tools RHEL 6 2.2.15-60.el6_9.6
  • httpd-manual RHEL 6 2.2.15-60.el6_9.6
  • jbcs-httpd24-httpd jboss core services 1 2.4.23-125.jbcs.el6
  • jbcs-httpd24-mod_bmx jboss core services 1 0.9.6-15.GA.jbcs.el6
  • jbcs-httpd24-mod_ssl jboss core services 1 1:2.4.23-125.jbcs.el6
  • jbcs-httpd24-mod_ldap jboss core services 1 2.4.23-125.jbcs.el6

red hat advisories RHSA-2017:2972RHSA-2017:3477RHSA-2017:3476RHSA-2017:3113RHSA-2017:2882RHSA-2017:3195

  • apache2 Studio Onsite 1.3, SLES for SAP 11 SP4, SLES 11 SP4 +4 more 2.2.34-70.12.1
  • apache2 SLES for SAP 12 SP1, SLES 12 SP1-LTSS, OpenStack Cloud 6 2.4.16-20.13.1
  • apache2 SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2 +4 more 2.4.23-29.6.1
  • apache2 SLES 12-LTSS 2.4.10-14.28.1

suse advisories SUSE-SU-2017:2907-1SUSE-SU-2017:2756-1SUSE-SU-2017:2718-1SUSE-SU-2017:2542-1

  • apache2 openSUSE Tumbleweed 2.4.49-1.1

opensuse advisories openSUSE-SU-2024:10623-1

  • apache2 Alpine 3.24, Alpine 3.23, Alpine 3.22 +19 more 2.4.27-r1

alpine advisories ALPINE-CVE-2017-9798

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • apache Arch Linux 2.4.27-2

arch linux advisories AVG-404

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-9798 updated cvss 5.9

httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed)

  • Red Hat Enterprise Linux 5 httpd Red Hat JBoss Web Server 3 httpd24
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Software Collections httpd24-httpd, httpd24-mod_md, httpd24-mod_ssl, httpd24-mod_ldap, httpd24-httpd-tools, httpd24-mod_session, +2 more
    affected: workaround, no fix available
  • Red Hat JBoss Enterprise Web Server 1 httpd
    under investigation
  • Red Hat Enterprise Linux Client Optional (v. 7) httpd 2.4.6-67.el7_4.5, mod_ssl 2.4.6-67.el7_4.5, mod_ldap 2.4.6-67.el7_4.5, httpd-tools 2.4.6-67.el7_4.5, mod_session 2.4.6-67.el7_4.5, httpd-manual 2.4.6-67.el7_4.5, +1 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd 2.4.6-67.el7_4.5, mod_ssl 2.4.6-67.el7_4.5, mod_ldap 2.4.6-67.el7_4.5, httpd-tools 2.4.6-67.el7_4.5, mod_session 2.4.6-67.el7_4.5, httpd-manual 2.4.6-67.el7_4.5, +1 more
    fixed: vendor fix RHSA-2017:2882
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.2) httpd 2.4.6-40.el7_2.6, mod_ssl 2.4.6-40.el7_2.6, mod_ldap 2.4.6-40.el7_2.6, httpd-tools 2.4.6-40.el7_2.6, mod_session 2.4.6-40.el7_2.6, httpd-manual 2.4.6-40.el7_2.6, +1 more
    fixed: vendor fix RHSA-2017:3193
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.3) httpd 2.4.6-45.el7_3.5, mod_ssl 2.4.6-45.el7_3.5, mod_ldap 2.4.6-45.el7_3.5, httpd-tools 2.4.6-45.el7_3.5, mod_session 2.4.6-45.el7_3.5, httpd-manual 2.4.6-45.el7_3.5, +1 more
    fixed: vendor fix RHSA-2017:3194
  • Red Hat Enterprise Linux Desktop (v. 6) httpd 2.2.15-60.el6_9.6, httpd-tools 2.2.15-60.el6_9.6 Red Hat Enterprise Linux Desktop Optional (v. 6) mod_ssl 2.2.15-60.el6_9.6, httpd-manual 2.2.15-60.el6_9.6 Red Hat Enterprise Linux HPC Node (v. 6) httpd 2.2.15-60.el6_9.6, httpd-tools 2.2.15-60.el6_9.6
    fixed: vendor fix RHSA-2017:2972
  • Red Hat Enterprise Linux HPC Node EUS (v. 6.7) httpd 2.2.15-47.el6_7.5, httpd-tools 2.2.15-47.el6_7.5
    fixed: vendor fix RHSA-2017:3195
show 20 more
  • Red Hat Enterprise Linux HPC Node Optional (v. 6) mod_ssl 2.2.15-60.el6_9.6, httpd-manual 2.2.15-60.el6_9.6
    fixed: vendor fix RHSA-2017:2972
  • Red Hat Enterprise Linux HPC Node Optional EUS (v. 6.7) mod_ssl 2.2.15-47.el6_7.5, httpd-manual 2.2.15-47.el6_7.5
    fixed: vendor fix RHSA-2017:3195
  • Red Hat Enterprise Linux Server (v. 6) httpd 2.2.15-60.el6_9.6, mod_ssl 2.2.15-60.el6_9.6, httpd-tools 2.2.15-60.el6_9.6, httpd-manual 2.2.15-60.el6_9.6
    fixed: vendor fix RHSA-2017:2972
  • Red Hat Enterprise Linux Server (v. 7) httpd 2.4.6-67.el7_4.5, mod_ssl 2.4.6-67.el7_4.5, httpd-tools 2.4.6-67.el7_4.5, mod_session 2.4.6-67.el7_4.5, httpd-manual 2.4.6-67.el7_4.5
    fixed: vendor fix RHSA-2017:2882
  • Red Hat Enterprise Linux Server EUS (v. 6.7) httpd 2.2.15-47.el6_7.5, mod_ssl 2.2.15-47.el6_7.5, httpd-tools 2.2.15-47.el6_7.5, httpd-manual 2.2.15-47.el6_7.5
    fixed: vendor fix RHSA-2017:3195
  • Red Hat Enterprise Linux Server EUS (v. 7.2) httpd 2.4.6-40.el7_2.6, mod_ssl 2.4.6-40.el7_2.6, httpd-tools 2.4.6-40.el7_2.6, httpd-manual 2.4.6-40.el7_2.6
    fixed: vendor fix RHSA-2017:3193
  • Red Hat Enterprise Linux Server EUS (v. 7.3) httpd 2.4.6-45.el7_3.5, mod_ssl 2.4.6-45.el7_3.5, httpd-tools 2.4.6-45.el7_3.5, httpd-manual 2.4.6-45.el7_3.5
    fixed: vendor fix RHSA-2017:3194
  • Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap 2.4.6-67.el7_4.5, mod_proxy_html 2.4.6-67.el7_4.5
    fixed: vendor fix RHSA-2017:2882
  • Red Hat Enterprise Linux Server Optional EUS (v. 7.2) mod_ldap 2.4.6-40.el7_2.6, mod_session 2.4.6-40.el7_2.6, mod_proxy_html 2.4.6-40.el7_2.6
    fixed: vendor fix RHSA-2017:3193
  • Red Hat Enterprise Linux Server Optional EUS (v. 7.3) mod_ldap 2.4.6-45.el7_3.5, mod_session 2.4.6-45.el7_3.5, mod_proxy_html 2.4.6-45.el7_3.5
    fixed: vendor fix RHSA-2017:3194
  • Red Hat Enterprise Linux Workstation (v. 6) httpd 2.2.15-60.el6_9.6, mod_ssl 2.2.15-60.el6_9.6, httpd-tools 2.2.15-60.el6_9.6, httpd-manual 2.2.15-60.el6_9.6
    fixed: vendor fix RHSA-2017:2972
  • Red Hat Enterprise Linux Workstation (v. 7) httpd 2.4.6-67.el7_4.5, mod_ssl 2.4.6-67.el7_4.5, httpd-tools 2.4.6-67.el7_4.5, mod_session 2.4.6-67.el7_4.5, httpd-manual 2.4.6-67.el7_4.5 Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap 2.4.6-67.el7_4.5, mod_proxy_html 2.4.6-67.el7_4.5
    fixed: vendor fix RHSA-2017:2882
  • Red Hat JBoss Core Services
    fixed: vendor fix RHSA-2017:3475
  • Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-httpd 2.4.23-125.jbcs.el6, jbcs-httpd24-mod_ssl 2.4.23-125.jbcs.el6, jbcs-httpd24-mod_bmx 0.9.6-15.GA.jbcs.el6, jbcs-httpd24-mod_ldap 2.4.23-125.jbcs.el6, jbcs-httpd24-httpd-libs 2.4.23-125.jbcs.el6, jbcs-httpd24-httpd-tools 2.4.23-125.jbcs.el6, +5 more
    fixed: vendor fix RHSA-2017:3477
  • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-httpd 2.4.23-125.jbcs.el7, jbcs-httpd24-mod_ssl 2.4.23-125.jbcs.el7, jbcs-httpd24-mod_bmx 0.9.6-15.GA.jbcs.el7, jbcs-httpd24-mod_ldap 2.4.23-125.jbcs.el7, jbcs-httpd24-httpd-libs 2.4.23-125.jbcs.el7, jbcs-httpd24-httpd-tools 2.4.23-125.jbcs.el7, +5 more
    fixed: vendor fix RHSA-2017:3476
  • Red Hat JBoss Enterprise Application Platform 6.4
    fixed: vendor fix RHSA-2017:3239
  • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server httpd 2.2.26-57.ep6.el6, mod_ssl 2.2.26-57.ep6.el6, mod_ldap 2.2.26-57.ep6.el6, httpd-tools 2.2.26-57.ep6.el6, httpd-manual 2.2.26-57.ep6.el6, jbcs-httpd24-openssl 1.0.2h-14.jbcs.el6, +3 more Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server httpd22 2.2.26-58.ep6.el7, mod_ssl22 2.2.26-58.ep6.el7, mod_ldap22 2.2.26-58.ep6.el7, httpd22-tools 2.2.26-58.ep6.el7, httpd22-manual 2.2.26-58.ep6.el7, jbcs-httpd24-openssl 1.0.2h-14.jbcs.el7, +3 more
    fixed: vendor fix RHSA-2017:3240
  • Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server httpd 2.2.26-57.ep6.el6, mod_ssl 2.2.26-57.ep6.el6, mod_ldap 2.2.26-57.ep6.el6, httpd-tools 2.2.26-57.ep6.el6, httpd-manual 2.2.26-57.ep6.el6, tomcat6 6.0.41-19_patch_04.ep6.el6, +23 more Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server httpd22 2.2.26-58.ep6.el7, mod_ssl22 2.2.26-58.ep6.el7, mod_ldap22 2.2.26-58.ep6.el7, httpd22-tools 2.2.26-58.ep6.el7, httpd22-manual 2.2.26-58.ep6.el7, tomcat6 6.0.41-19_patch_04.ep6.el7, +23 more
    fixed: vendor fix RHSA-2017:3113
  • Red Hat JBoss Web Server 2.1
    fixed: vendor fix RHSA-2017:3114
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24 1.1-18.el6, httpd24-httpd 2.4.27-8.el6, httpd24-runtime 1.1-18.el6, httpd24-scldevel 1.1-18.el6, httpd24-mod_ssl 2.4.27-8.el6, httpd24-mod_ldap 2.4.27-8.el6, +4 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24 1.1-18.el7, httpd24-curl 7.47.1-4.el7, httpd24-httpd 2.4.27-8.el7, httpd24-runtime 1.1-18.el7, httpd24-nghttp2 1.7.1-6.el7, httpd24-scldevel 1.1-18.el7, +9 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) httpd24 1.1-18.el6, httpd24-httpd 2.4.27-8.el6, httpd24-runtime 1.1-18.el6, httpd24-scldevel 1.1-18.el6, httpd24-mod_ssl 2.4.27-8.el6, httpd24-mod_ldap 2.4.27-8.el6, +4 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) httpd24 1.1-18.el7, httpd24-curl 7.47.1-4.el7, httpd24-httpd 2.4.27-8.el7, httpd24-runtime 1.1-18.el7, httpd24-nghttp2 1.7.1-6.el7, httpd24-scldevel 1.1-18.el7, +9 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) httpd24 1.1-18.el7, httpd24-curl 7.47.1-4.el7, httpd24-httpd 2.4.27-8.el7, httpd24-runtime 1.1-18.el7, httpd24-nghttp2 1.7.1-6.el7, httpd24-scldevel 1.1-18.el7, +9 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24 1.1-18.el6, httpd24-httpd 2.4.27-8.el6, httpd24-runtime 1.1-18.el6, httpd24-scldevel 1.1-18.el6, httpd24-mod_ssl 2.4.27-8.el6, httpd24-mod_ldap 2.4.27-8.el6, +4 more
    fixed: vendor fix RHSA-2017:3018

1 more fixed, 1 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit auxiliary/scanner/http/apache_optionsbleed)
  2. Published

Exploit prediction

94.65% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit auxiliary/scanner/http/apache_optionsbleed Apache Optionsbleed Scanner metasploit auxiliary, normal rank, 2017-09-18
  • EDB-42745 Apache < 2.2.34 / < 2.4.27 - OPTIONS Memory Leak webapps, 2017-09-18
  • blog.fuzzing-project.org https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch referenced PoC, tagged "exploit" by a source, unverified
  • blog.fuzzing-project.org https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/hannob/optionsbleed referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • Apache Software Foundation Apache HTTP Server

Classification

Weakness
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.