CVE-2020-9490

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.20 through 2.4.43

Description The issue is related to the implementation of the HTTP/2 mechanism in the Apache HTTP Server, which is associated with inconsistent interpretation of HTTP requests. This can allow a remote attacker to cause a denial of service. A specially crafted value for the Cache-Digest header in a HTTP/2 request would result in a crash when the server tries to HTTP/2 PUSH a resource afterwards.

Recommendations For Apache HTTP Server versions 2.4.20 through 2.4.43, configuring the HTTP/2 feature via "H2Push off" will mitigate this issue for unpatched servers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.