CVE-2017-9798 Use after free in Apache HTTP Server

High 7.5 Published 18 Sep 2017 Updated 4 Nov 2025

Remote attackers can read secret data from process memory via unauthenticated OPTIONS requests due to a use-after-free flaw in Apache HTTP Server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-9798?

CVE-2017-9798 is a high-severity use after free vulnerability in Apache Http Server, published on 18 Sep 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.

Weakness: CWE-416

Which versions are affected by CVE-2017-9798?

It affects 2 products.

Linux distribution packages (40)

`httpd` Red Hat:enterprise_linux:7::client	All versions	`0:2.4.6-67.el7_4.5`
`httpd-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:2.4.6-67.el7_4.5`
`httpd-devel` Red Hat:enterprise_linux:7::client	All versions	`0:2.4.6-67.el7_4.5`
`httpd-manual` Red Hat:enterprise_linux:7::client	All versions	`0:2.4.6-67.el7_4.5`
`httpd-tools` Red Hat:enterprise_linux:7::client	All versions	`0:2.4.6-67.el7_4.5`
`mod_ldap` Red Hat:enterprise_linux:7::client	All versions	`0:2.4.6-67.el7_4.5`
`mod_proxy_html` Red Hat:enterprise_linux:7::client	All versions	`1:2.4.6-67.el7_4.5`
`mod_session` Red Hat:enterprise_linux:7::client	All versions	`0:2.4.6-67.el7_4.5`
`mod_ssl` Red Hat:enterprise_linux:7::client	All versions	`1:2.4.6-67.el7_4.5`
`httpd` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.4.6-67.el7_4.5`
`httpd-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.4.6-67.el7_4.5`
`httpd-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.4.6-67.el7_4.5`
`httpd-manual` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.4.6-67.el7_4.5`
`httpd-tools` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.4.6-67.el7_4.5`
`mod_ldap` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.4.6-67.el7_4.5`
`mod_proxy_html` Red Hat:enterprise_linux:7::computenode	All versions	`1:2.4.6-67.el7_4.5`
`mod_session` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.4.6-67.el7_4.5`
`mod_ssl` Red Hat:enterprise_linux:7::computenode	All versions	`1:2.4.6-67.el7_4.5`
`httpd` Red Hat:enterprise_linux:7::server	All versions	`0:2.4.6-67.el7_4.5`
`httpd-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:2.4.6-67.el7_4.5`
`httpd-devel` Red Hat:enterprise_linux:7::server	All versions	`0:2.4.6-67.el7_4.5`
`httpd-manual` Red Hat:enterprise_linux:7::server	All versions	`0:2.4.6-67.el7_4.5`
`httpd-tools` Red Hat:enterprise_linux:7::server	All versions	`0:2.4.6-67.el7_4.5`
`mod_ldap` Red Hat:enterprise_linux:7::server	All versions	`0:2.4.6-67.el7_4.5`
`mod_proxy_html` Red Hat:enterprise_linux:7::server	All versions	`1:2.4.6-67.el7_4.5`
`mod_session` Red Hat:enterprise_linux:7::server	All versions	`0:2.4.6-67.el7_4.5`
`mod_ssl` Red Hat:enterprise_linux:7::server	All versions	`1:2.4.6-67.el7_4.5`
`httpd` Red Hat:enterprise_linux:7::workstation	All versions	`0:2.4.6-67.el7_4.5`
`httpd-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:2.4.6-67.el7_4.5`
`httpd-devel` Red Hat:enterprise_linux:7::workstation	All versions	`0:2.4.6-67.el7_4.5`
`httpd-manual` Red Hat:enterprise_linux:7::workstation	All versions	`0:2.4.6-67.el7_4.5`
`httpd-tools` Red Hat:enterprise_linux:7::workstation	All versions	`0:2.4.6-67.el7_4.5`
`mod_ldap` Red Hat:enterprise_linux:7::workstation	All versions	`0:2.4.6-67.el7_4.5`
`mod_proxy_html` Red Hat:enterprise_linux:7::workstation	All versions	`1:2.4.6-67.el7_4.5`
`mod_session` Red Hat:enterprise_linux:7::workstation	All versions	`0:2.4.6-67.el7_4.5`
`mod_ssl` Red Hat:enterprise_linux:7::workstation	All versions	`1:2.4.6-67.el7_4.5`
`httpd24` Red Hat:rhel_software_collections:3::el6	All versions	`0:1.1-18.el6`
`httpd24-httpd` Red Hat:rhel_software_collections:3::el6	All versions	`0:2.4.27-8.el6`
`httpd24-httpd-debuginfo` Red Hat:rhel_software_collections:3::el6	All versions	`0:2.4.27-8.el6`
`httpd24-httpd-devel` Red Hat:rhel_software_collections:3::el6	All versions	`0:2.4.27-8.el6`

Products include Apache Http Server, Debian Debian Linux.

How do I fix CVE-2017-9798?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2017-9798 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-9798 exists.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 4 proofs of concept on GitHub.

All Apache Http Server vulnerabilities

Sources

Also known as ALPINE-CVE-2017-9798, CLEANSTART-2026-BD59133, DEBIAN-CVE-2017-9798, DLA-1102-1, DSA-3980-1, GHSA-jxf6-fx3m-8x2r and 7 more.