Apache 2.4.x < 2.4.59 Multiple Vulnerabilities

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.59. It is, therefore, affected by multiple vulnerabilities:

• Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. (CVE-2023-38709)

• HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. (CVE-2024-24795)

• HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion. (CVE-2024-27316)

Note that the scanner has not tested for these issues but has instead relied only on the application’s self-reported version number.