CVE-2017-9798observed exploitation

CVE-2017-9798: vulnerability in Apache HTTP Server

Published 18 Sep 2017 · Updated 04 Nov 2025

82Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 95%

from disclosure to weapon0 days

Published on NVDSep 18

1st PoCSep 18

metasploitSep 18

VulnCheck+1618d

exploitation probability

95%top 1% of all CVEs

observed exploitation

yesVulnCheck

9 public exploit(s)

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Affected

3 products (12 components)

Red Hat Software Collections · Red Hat Enterprise Linux 5 · Red Hat JBoss Web Server 3

workaround: This issue can be mitigated by configuring httpd to disallow the use of the "Limit" configuration directive in .htaccess files. The set of directives that can be used in .htaccess files is configured using the "AllowOverride" directive…

Fixed

37 products (796 components)

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) · Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server · Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server · and others 32

fix ↗

Under investigation

1 product

Red Hat JBoss Enterprise Web Server 1

Not affected

1 product — because the vulnerable code is not present in the product

Red Hat JBoss Enterprise Application Platform 5

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.

Affected products

Apache Software Foundation · Apache HTTP Server

public PoCs found — 9

exploitdbwww.exploit-db.com/exploits/42745unverified githubgithub.com/brokensound77/OptionsBleed-POC-Scanner★ 19 githubgithub.com/nitrado/CVE-2017-9798★ 3 githubgithub.com/pabloec20/optionsbleed★ 2 githubgithub.com/l0n3rs/CVE-2017-9798★ 0 vulncheckvulncheck.com/xdb/c84b62822dafunverified vulncheckvulncheck.com/xdb/43b46934de5eunverified vulncheckvulncheck.com/xdb/b11f158716deunverified cve_referencewww.exploit-db.com/exploits/42745/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — Apache HTTP Server

In the same product, most dangerous first.

CVE-2021-40438CRITICALmod_proxy SSRFEPSS 100.0%KEV CVE-2021-41773HIGHPath traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49EPSS 100.0%KEV CVE-2021-42013CRITICALPath Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)EPSS 100.0%KEV CVE-2024-38475CRITICALApache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.EPSS 100.0%KEV CVE-2021-44790—Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlierEPSS 96.8%CVE-2024-27316HIGHApache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation framesEPSS 91.3%

References