CVE-2016-4979

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-4979
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4979.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-4979
Downstream
Related
Published
2016-07-06T14:59:04Z
Modified
2026-09-23T08:06:45Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation.

References

Affected packages

Git / github.com/apache/httpd

Affected ranges

Type
GIT
Repo
https://github.com/apache/httpd
Events
Introduced
b7ef32c4957883ab17105fa82e6331bf48bed78a
Last Affected
6e65a7f3dadcade4274ae53f734d4c35188e3786
Fixed
2d0e4eff04ea963128a41faaef21f987272e05a2
Database specific
Show details 
{
    "cpe":  [
        "cpe:2.3:a:apache:http_server:2.4.18:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.19:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.20:*:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "2.4.18"
        },
        {
            "last_affected":  "2.4.18"
        },
        {
            "introduced":  "2.4.19"
        },
        {
            "last_affected":  "2.4.19"
        },
        {
            "introduced":  "2.4.20"
        },
        {
            "last_affected":  "2.4.20"
        }
    ],
    "source":  [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.4.18
2.4.19
2.4.20

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4979.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "285512666638282015489581124945252142619",
            "length":  13247
        },
        "id":  "CVE-2016-4979-5eec88a5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/apache/httpd/commit/2d0e4eff04ea963128a41faaef21f987272e05a2",
        "target":  {
            "file":  "modules/ssl/ssl_engine_kernel.c",
            "function":  "ssl_hook_Access"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "244385919861610858721936967085811442209",
                "308071227496002563137936932201529329994",
                "158621415921638913253691990362977946518",
                "320008290054834887054868414971497180225"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2016-4979-f37c52b9",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/apache/httpd/commit/2d0e4eff04ea963128a41faaef21f987272e05a2",
        "target":  {
            "file":  "modules/ssl/ssl_engine_kernel.c"
        }
    }
]
vanir_signatures_modified 
"2026-09-23T08:06:45Z"