CVE-2020-9490

Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in…

7.5HighCVSS base score
88.8%Exploitation in 30 daysEPSS · top 0.2% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.

Timeline

2020
1 Mar 2020
1 Mar 2020
ID reserved
By apache
7 Aug 20205 months later
7 Aug 2020· 5 months later
Published
2024
4 Aug 20244 years later
4 Aug 2024· 4 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2020-9490, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (exploitation in 30 days): 88.8% · top 0.2% of all CVEs (11 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Affected products

Apache HTTP Server
- affected 2.4.20 to 2.4.43

References

https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-9490 (opens in a new tab)x_refsource_MISCx_transferred
GLSA-202008-04 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
[httpd-dev] 20200808 Security announcements for CVE-2020-9490/CVE-2020-11993 ? (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-dev] 20200811 Which version fixed the CVE-2020-9490, CVE-2020-11984 and CVE-2020-11993 vulnerabilities? (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-dev] 20200811 Re: Which version fixed the CVE-2020-9490, CVE-2020-11984 and CVE-2020-11993 vulnerabilities? (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
USN-4458-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
FEDORA-2020-8122a8daa2 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
FEDORA-2020-b58dc5df38 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
openSUSE-SU-2020:1285 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
openSUSE-SU-2020:1293 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
DSA-4757 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
https://www.oracle.com/security-alerts/cpuoct2020.html (opens in a new tab)x_refsource_MISCx_transferred
https://security.netapp.com/advisory/ntap-20200814-0005/ (opens in a new tab)x_refsource_CONFIRMx_transferred
openSUSE-SU-2020:1792 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
https://www.oracle.com/security-alerts/cpujan2021.html (opens in a new tab)x_refsource_MISCx_transferred
http://packetstormsecurity.com/files/160392/Apache-2.4.43-mod_http2-Memory-Corruption.html (opens in a new tab)x_refsource_MISCx_transferred
[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073143 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1888194 [13/13] - /httpd/site/trunk/content/security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073139 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1888203 - /httpd/site/trunk/content/security/json/CVE-2020-9490.json (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073148 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-9490.json (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073149 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210407 svn commit: r1073454 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-9490.json security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210407 svn commit: r1888469 - /httpd/site/trunk/content/security/json/CVE-2020-9490.json (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210603 svn commit: r1075355 - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2020-9490](https://cveledger.app/badge/CVE-2020-9490.svg)](https://cveledger.app/cve/CVE-2020-9490)

Record last updated 4 Aug 2024, 10:26 UTC.