{"id":"CVE-2017-9798","published":"2017-09-18T15:00:00Z","modified":"2025-11-04T16:09:11Z","title":"Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a…","vendor":"Apache Software Foundation","product":"Apache HTTP Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache HTTP Server","versions":["Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27"]}],"description":{"text":"Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in Apache HTTP Server (Apache Software Foundation), where a use-after-free in the handling of the Limit directive can cause secret data from process memory to be exposed. An unauthenticated remote attacker can exploit it by sending an OPTIONS HTTP request, but only when the Limit directive can be set in a user's .htaccess file or httpd.conf has certain misconfigurations, and the data returned depends on many configuration factors and is not always disclosed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:38Z"},"cvss":null,"epss":{"score":0.94999,"percentile":0.99861,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2022-02-22","exploitedFirstSeen":"2022-02-22","ransomware":true,"evidence":[{"url":"https://www.trendmicro.com/en_us/research/22/b/recent-cyberattacks-open-source-web-servers.html","date":"2022-02-22"},{"url":"https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf","date":"2023-02-14"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":5,"pulses":[{"name":"Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files","url":"https://otx.alienvault.com/pulse/664cc3c1938ed0b9abf026a2","created":"2024-05-21"},{"name":"smtech.hr  - 194.135.80.88 - #FANOS -   vuln to 24 CVE's","url":"https://otx.alienvault.com/pulse/6285ac654db92004b788b4ae","created":"2022-05-19"},{"name":"SMS Phisphing Campaign","url":"https://otx.alienvault.com/pulse/62826e6e99e1c6ccf06b100e","created":"2022-05-16"},{"name":"103.224.212.227 - cve-2019-0220 cdn/supplychain","url":"https://otx.alienvault.com/pulse/625d4ab4eb07779bf6221298","created":"2022-04-18"},{"name":"Internal CVE Research","url":"https://otx.alienvault.com/pulse/6228b4f0b2d5ade72cc7a0ea","created":"2022-03-09"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:3113","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/100872","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2882","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2972","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch","tags":["x_refsource_MISC"]},{"url":"https://support.apple.com/HT208331","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id/1039387","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3475","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://github.com/hannob/optionsbleed","tags":["x_refsource_MISC"]},{"url":"https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch","tags":["x_refsource_MISC"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3240","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3195","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3018","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3239","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3476","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/105598","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798","tags":["x_refsource_CONFIRM"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3114","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3477","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://openwall.com/lists/oss-security/2017/09/18/2","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20180601-0003/","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3194","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-9798","tags":["x_refsource_MISC"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3193","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.debian.org/security/2017/dsa-3980","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html","tags":["x_refsource_MISC"]},{"url":"https://www.exploit-db.com/exploits/42745/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://security.gentoo.org/glsa/201710-32","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.tenable.com/security/tns-2019-09","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://github.com/apache/httpd/commit/4cc27823899e070268b906ca677ee838d07cf67a","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://seclists.org/fulldisclosure/2024/Sep/22","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-18719","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-18719","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":42745,"url":"https://www.exploit-db.com/exploits/42745","title":"Apache < 2.2.34 / < 2.4.27 - OPTIONS Memory Leak","type":"webapps","platform":"linux","date":"2017-09-18","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2017-09-18"},"pocGithub":{"count":3,"skipped":1,"earliest":"2017-09-18","earliestUrl":"https://github.com/nitrado/CVE-2017-9798","repos":[{"name":"brokensound77/OptionsBleed-POC-Scanner","url":"https://github.com/brokensound77/OptionsBleed-POC-Scanner","stars":19,"created":"2017-09-27"},{"name":"nitrado/CVE-2017-9798","url":"https://github.com/nitrado/CVE-2017-9798","stars":3,"created":"2017-09-18"},{"name":"pabloec20/optionsbleed","url":"https://github.com/pabloec20/optionsbleed","stars":2,"created":"2017-09-20"}]},"metasploit":[{"name":"Apache Optionsbleed Scanner","module":"auxiliary/scanner/http/apache_optionsbleed","type":"auxiliary","disclosureDate":"2017-09-18","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/apache_optionsbleed.rb"}],"first":{"date":"2017-09-18","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/42745"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/42745/"],"flow":[],"timeline":[{"date":"2017-09-18","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2017-9798","provenance":"source"},{"date":"2017-09-18","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-42745); later: PoC-in-GitHub 2017-09-18, Metasploit 2017-09-18","url":"https://www.exploit-db.com/exploits/42745","provenance":"source"},{"date":"2022-02-22","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.trendmicro.com/en_us/research/22/b/recent-cyberattacks-open-source-web-servers.html","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":71.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1710 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9986"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 3 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":1.77,"detail":"5 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}