CVE-2020-9490: Apache HTTP Server

High severity, CVSS 7.5. EPSS: 88.8% chance of exploitation in the next 30 days.

Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.

Affected products

  • Apache HTTP Server: from 2.4.20, before 2.4.46 (fixed in 2.4.46)
  • Canonical Ubuntu Linux: version 16.04 only; version 18.04 only; version 20.04 only
  • Debian Debian Linux: version 10.0 only
  • Fedoraproject Fedora: version 31 only; version 32 only
  • Opensuse Leap: version 15.1 only; version 15.2 only
  • Oracle Communications Element Manager: from 8.2.0, up to and including 8.2.2
  • Oracle Communications Session Report Manager: from 8.2.0, up to and including 8.2.2
  • Oracle Communications Session Route Manager: from 8.2.0, up to and including 8.2.2
  • Oracle Enterprise Manager Ops Center: version 12.4.0.0 only
  • Oracle Hyperion Infrastructure Technology: version 11.1.2.4 only
  • Oracle Instantis Enterprisetrack: version 17.1 only; version 17.2 only; version 17.3 only
  • Oracle ZFS Storage Appliance Kit: version 8.8 only
  • Red Hat Enterprise Linux: version 8.0 only
  • Red Hat Enterprise Linux Eus: version 8.1 only; version 8.2 only; version 8.4 only; version 8.6 only
  • Red Hat Enterprise Linux For IBM Z Systems: version 8.0 only
  • Red Hat Enterprise Linux For IBM Z Systems Eus: version 8.1 only; version 8.2 only; version 8.4 only; version 8.6 only
  • Red Hat Enterprise Linux For Power Little Endian: version 8.0 only
  • Red Hat Enterprise Linux For Power Little Endian Eus: version 8.1 only; version 8.2 only; version 8.4 only; version 8.6 only
  • Red Hat Enterprise Linux Server Aus: version 8.2 only; version 8.4 only; version 8.6 only
  • Red Hat Enterprise Linux Server For Power Little Endian Update Services For SAP Solutions: version 8.1 only; version 8.2 only; version 8.4 only; version 8.6 only
  • Red Hat Enterprise Linux Server Tus: version 8.2 only; version 8.4 only; version 8.6 only
  • Red Hat Enterprise Linux Server Update Services For SAP Solutions: version 8.1 only; version 8.2 only; version 8.4 only; version 8.6 only
  • Red Hat Openstack: version 16.1 only
  • Red Hat Openstack For IBM Power: version 16.1 only
  • Red Hat Software Collections: version 1.0 only

Published 2020-08-07. Last modified 2026-06-17.