What is CVE-2016-8740?

CVE-2016-8740 is a high-severity vulnerability in Apache HTTP Server, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2016-12-05.

How severe is CVE-2016-8740?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2016-8740 known to be exploited?

9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in Apache HTTP Server

CVE-2016-8740

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published 2016-12-05 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.791 (99.6th percentile), scored 2026-10-17.

High probability of exploitation in the next 30 days — patch promptly. 100th percentile — 99.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.791 · newest: 0.791 · change: 0.000

Affected products

Apache HTTP Server — versions 2.4.17, 2.4.18, 2.4.19
Apache Software Foundation HTTP Server — versions 2.4.17 - 2.4.23

Weakness classification (CWE)

Public proof-of-concept exploits

References

support.apple.com/HT208221
github.com/apache/httpd/commit/29c63b786ae028d82405421585e91283c8fa0da3 (Patch, Third Party Advisory, Issue Tracking)
www.securitytracker.com/id/1037388 (VDB Entry, Third Party Advisory, vdb-entry)
packetstormsecurity.com/files/140023/Apache-HTTPD-Web-Server-2.4.23-Memory-Exha… (Exploit, VDB Entry, Third Party Advisory)
access.redhat.com/errata/RHSA-2017:1413 (vendor-advisory)
access.redhat.com/errata/RHSA-2017:1161 (vendor-advisory)
www.tenable.com/security/tns-2017-04
access.redhat.com/errata/RHSA-2017:1414 (vendor-advisory)
h20566.www2.hpe.com/hpsc/doc/public/display
www.exploit-db.com/exploits/40909/ (Exploit, VDB Entry, Third Party Advisory, exploit)

Frequently asked questions

What is CVE-2016-8740?: CVE-2016-8740 is a high-severity vulnerability in Apache HTTP Server, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2016-12-05.
How severe is CVE-2016-8740?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2016-8740 known to be exploited?: 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.