Apache Software Foundation Apache HTTP Server: Apache httpd allows remote attackers to read secret data from process memory if the Limit…

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

No source has published a CVSS score for this record yet.

• CISA KEV Not listed.
• EPSS 0.95, the 99th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 18 Sept 2017. New records show when each source confirmed them.

Sources

• CVE List: CVE-2017-9798
• NVD: CVE-2017-9798

References from the CNA

• access.redhat.com/errata/RHSA-2017:3113 vendor-advisoryredhat
• www.securityfocus.com/bid/100872 vdb-entrybid
• www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html confirm
• www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html confirm
• www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html confirm
• access.redhat.com/errata/RHSA-2017:2882 vendor-advisoryredhat
• access.redhat.com/errata/RHSA-2017:2972 vendor-advisoryredhat
• blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch
• support.apple.com/HT208331 confirm
• www.securitytracker.com/id/1039387 vdb-entrysectrack
• support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us confirm
• access.redhat.com/errata/RHSA-2017:3475 vendor-advisoryredhat
• github.com/hannob/optionsbleed
• svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch
• access.redhat.com/errata/RHSA-2017:3240 vendor-advisoryredhat
• access.redhat.com/errata/RHSA-2017:3195 vendor-advisoryredhat
• access.redhat.com/errata/RHSA-2017:3018 vendor-advisoryredhat
• www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html confirm
• access.redhat.com/errata/RHSA-2017:3239 vendor-advisoryredhat
• access.redhat.com/errata/RHSA-2017:3476 vendor-advisoryredhat
• www.securityfocus.com/bid/105598 vdb-entrybid
• httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798 confirm
• www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html confirm
• access.redhat.com/errata/RHSA-2017:3114 vendor-advisoryredhat
• access.redhat.com/errata/RHSA-2017:3477 vendor-advisoryredhat
• openwall.com/lists/oss-security/2017/09/18/2
• security.netapp.com/advisory/ntap-20180601-0003/ confirm
• access.redhat.com/errata/RHSA-2017:3194 vendor-advisoryredhat
• security-tracker.debian.org/tracker/CVE-2017-9798
• access.redhat.com/errata/RHSA-2017:3193 vendor-advisoryredhat

And 25 more on the CVE record.

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.