Search for vulnerabilities
Vulnerability details: VCID-xxsu-sm1s-qkey
Vulnerability ID VCID-xxsu-sm1s-qkey
Aliases CVE-2016-1546
Summary By manipulating the flow control windows on streams, a client was able to block server threads for long times, causing starvation of worker threads. Connections could still be opened, but no streams where processed for these. This issue affected HTTP/2 support in 2.4.17 and 2.4.18.
Status Published
Exploitability 0.5
Weighted Severity 2.1
Risk 1.1
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.22779 https://api.first.org/data/v1/epss?cve=CVE-2016-1546
epss 0.23141 https://api.first.org/data/v1/epss?cve=CVE-2016-1546
epss 0.23141 https://api.first.org/data/v1/epss?cve=CVE-2016-1546
epss 0.23141 https://api.first.org/data/v1/epss?cve=CVE-2016-1546
epss 0.25386 https://api.first.org/data/v1/epss?cve=CVE-2016-1546
epss 0.25386 https://api.first.org/data/v1/epss?cve=CVE-2016-1546
epss 0.25386 https://api.first.org/data/v1/epss?cve=CVE-2016-1546
epss 0.25386 https://api.first.org/data/v1/epss?cve=CVE-2016-1546
epss 0.25386 https://api.first.org/data/v1/epss?cve=CVE-2016-1546
epss 0.25386 https://api.first.org/data/v1/epss?cve=CVE-2016-1546
epss 0.25386 https://api.first.org/data/v1/epss?cve=CVE-2016-1546
epss 0.25386 https://api.first.org/data/v1/epss?cve=CVE-2016-1546
epss 0.25386 https://api.first.org/data/v1/epss?cve=CVE-2016-1546
apache_httpd low https://httpd.apache.org/security/json/CVE-2016-1546.json
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-1546.json
https://api.first.org/data/v1/epss?cve=CVE-2016-1546
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1546
1336350 https://bugzilla.redhat.com/show_bug.cgi?id=1336350
CVE-2016-1546 https://httpd.apache.org/security/json/CVE-2016-1546.json
RHSA-2017:1161 https://access.redhat.com/errata/RHSA-2017:1161
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.95651
EPSS Score 0.22779
Published At Aug. 16, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:29:01.083709+00:00 Apache HTTPD Importer Import https://httpd.apache.org/security/json/CVE-2016-1546.json 37.0.0