What’s Vulnerable › Vulnerabilities

CVE-2017-7668

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 57.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-06-20 · updated 2026-06-17
• Weakness: CWE-126

Description

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.

Affected products

• Apache HTTP Server: 2.2.32, 2.4.24, 2.4.25
• macOS: before 10.13.1; from 10.11.0 before 10.11.6; from 10.12.0 before 10.12.6; 10.11.6, 10.11.6-security_update_2016-001, 10.11.6-security_update_2016-002, 10.11.6-security_update_2016-003, 10.11.6-security_update_2017-001, 10.11.6-security_update_2017-002 (+2) — fixed in 10.11.6, 10.12.6, 10.13.1
• Debian Linux: 8.0, 9.0
• Clustered Data ONTAP: all versions
• NetApp OnCommand Unified Manager for 7-Mode (core package): all versions
• NetApp StorageGRID: all versions
• Oracle Corporation Secure Global Desktop: 5.3
• RedHat Enterprise Linux Desktop: 7.0
• RedHat Enterprise Linux Eus: 7.2, 7.3, 7.4, 7.5, 7.6, 7.7
• RedHat Enterprise Linux Server: 7.0
• RedHat Enterprise Linux Server Aus: 7.2, 7.3, 7.4, 7.6, 7.7
• RedHat Enterprise Linux Server Tus: 7.2, 7.3, 7.4, 7.6, 7.7
• RedHat Enterprise Linux Workstation: 7.0

How to fix

Upgrade to a fixed version: macOS 10.11.6, 10.12.6, 10.13.1. Check the vendor advisory for mitigations.

References

• http://www.debian.org/security/2017/dsa-3896
• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
• http://www.securityfocus.com/bid/99137
• http://www.securitytracker.com/id/1038711
• https://access.redhat.com/errata/RHSA-2017:2479
• https://access.redhat.com/errata/RHSA-2017:2483
• https://access.redhat.com/errata/RHSA-2017:3193
• https://access.redhat.com/errata/RHSA-2017:3194
• https://lists.apache.org/thread.html/55a068b6a5eec0b3198ae7d96a7cb412352d0ffa7716612c5af3745b%40%3Cdev.httpd.apache.org%3E
• https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

Get alerted when CVE-2017-7668 or the next vulnerability affects your stack