CVE-2020-11993: Apache HTTP Server

High severity, CVSS 7.5. EPSS: 56.4% chance of exploitation in the next 30 days.

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.

Affected products

• Apache HTTP Server: from 2.4.20, before 2.4.44 (fixed in 2.4.44)
• Canonical Ubuntu Linux: version 16.04 only; version 18.04 only; version 20.04 only
• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 31 only; version 32 only
• Netapp Clustered Data Ontap: affected versions not specified
• Opensuse Leap: version 15.1 only; version 15.2 only
• Oracle Communications Element Manager: from 8.2.0, up to and including 8.2.2
• Oracle Communications Session Report Manager: from 8.2.0, up to and including 8.2.2
• Oracle Communications Session Route Manager: from 8.2.0, up to and including 8.2.2
• Oracle Enterprise Manager Ops Center: version 12.4.0.0 only
• Oracle Hyperion Infrastructure Technology: version 11.1.2.4 only
• Oracle Instantis Enterprisetrack: version 17.1 only; version 17.2 only; version 17.3 only
• Oracle ZFS Storage Appliance Kit: version 8.8 only

Published 2020-08-07. Last modified 2026-06-17.