---
id: c8d6d0a5-baa9-4799-81f4-d1bb2d167675
---

# Large Request Payloads in Apache HTTP.
---

This incident type refers to situations where the Apache HTTP server receives unusually large request payloads from clients. A request payload is the data that a client sends to the server as part of a request. When the payload is too large, it can cause various issues such as performance degradation, timeouts, and even server crashes. These incidents can affect the availability and reliability of the server, and they need to be addressed promptly to prevent further impact on the system.

### Parameters
```shell
export APACHE_PORT="PLACEHOLDER"

export NETWORK_INTERFACE="PLACEHOLDER"

export VIRTUAL_HOST_CONFIG_FILE="PLACEHOLDER"

export APACHE_CONFIG_FILE_PATH="PLACEHOLDER"

export MAXIMUM_PAYLOAD_SIZE="PLACEHOLDER"
```

## Debug

### Check if Apache is running
```shell
systemctl status apache2
```

### Check Apache error logs for any related error
```shell
tail -n 50 /var/log/apache2/error.log
```

### Check the size of incoming HTTP requests
```shell
tcpdump -i ${NETWORK_INTERFACE} port ${APACHE_PORT} -s 0 -A 'tcp[(tcp[12]>>4)*4]=0x47455420' | grep "Content-Length"
```

### Check the Apache configuration file for the maximum allowed request size
```shell
cat /etc/apache2/apache2.conf | grep "LimitRequestBody"
```

### Check the Apache virtual host configuration file for the maximum allowed request size
```shell
cat /etc/apache2/sites-available/${VIRTUAL_HOST_CONFIG_FILE} | grep "LimitRequestBody"
```

### Check the Apache HTTP headers for any information about the request
```shell
curl -I http://localhost:${APACHE_PORT}
```

### Check the Apache access logs for the incoming request details
```shell
tail -n 50 /var/log/apache2/access.log
```

## Repair

### Increase the maximum allowed size for request payloads in the Apache settings.
```shell

#!/bin/bash

# Set the maximum allowed size for request payloads

${APACHE_CONFIG_FILE_PATH}=/etc/httpd/conf/httpd.conf

${MAXIMUM_PAYLOAD_SIZE}="10MB"

# Backup the original Apache config file

cp ${APACHE_CONFIG_FILE_PATH} ${APACHE_CONFIG_FILE_PATH}.bak

# Update the Apache config file with the new maximum payload size

sed -i 's/^$LimitRequestBody\s*$.*/\1${MAXIMUM_PAYLOAD_SIZE}/' ${APACHE_CONFIG_FILE_PATH}


# Restart Apache to apply the changes

service httpd restart


```

This incident type refers to situations where the Apache HTTP server receives unusually large request payloads from clients. A request payload is the data that a client sends to the server as part of a request. When the payload is too large, it can cause various issues such as performance degradation, timeouts, and even server crashes. These incidents can affect the availability and reliability of the server, and they need to be addressed promptly to prevent further impact on the system.


This incident type occurs when the size of HTTP request headers or payload exceeds the limits set by Tomcat server. When this happens, the server may reject the request or return an error message, causing disruption to the normal functioning of the web application. This can be caused by a variety of factors, including large file uploads, excessive use of cookies or query parameters, or attacks that intentionally send oversized requests.


Tomcat HTTP Request Headers or Payload Size Exceeds Limits.

This incident type refers to frequent mismatches between the virtual hosts configured on an Apache server. This can cause issues with routing traffic to the intended web application or website, resulting in downtime or other problems. It is important to address these mismatches promptly to ensure the proper functioning of the server and any associated applications.


Virtual Host Mismatches on Apache Server.

This incident type refers to an unauthorized access to directories in Apache HTTPD, which is a widely used web server software. It means that someone was able to access files or directories that they were not supposed to, without having proper authorization. This type of incident can potentially lead to sensitive data being exposed or even stolen, and can compromise the security of the server and the applications running on it.


Unauthorized Directory Access in Apache HTTPD.

The Slowloris Attack is a type of Denial of Service (DoS) attack that exploits a vulnerability in the Apache web server. It works by sending HTTP requests to the server and keeping those connections open for as long as possible, thereby using up all the available resources of the server and rendering it unresponsive to legitimate requests. As a result, the server becomes slow or unresponsive, causing downtime for the affected website or service. This type of attack can be detected and mitigated by implementing specific security measures and tools.


Slowloris Attack Detected on Apache server.

This incident type refers to the detection of SQL injection attempts in Apache web server logs. SQL injection is a type of cyber attack that exploits vulnerabilities in web applications allowing attackers to execute malicious SQL statements. In this incident, attackers are attempting to inject SQL code into the URI (Uniform Resource Identifier) of an Apache web server, potentially compromising the server's security and exposing sensitive information.


Apache SQL Injection Attempts in URI Incident

```shell
export APACHE_PORT="PLACEHOLDER"

export NETWORK_INTERFACE="PLACEHOLDER"

export VIRTUAL_HOST_CONFIG_FILE="PLACEHOLDER"

export APACHE_CONFIG_FILE_PATH="PLACEHOLDER"

export MAXIMUM_PAYLOAD_SIZE="PLACEHOLDER"
```


### Check if Apache is running

```shell
systemctl status apache2
```

### Check Apache error logs for any related error

```shell
tail -n 50 /var/log/apache2/error.log
```

### Check the size of incoming HTTP requests

```shell
tcpdump -i ${NETWORK_INTERFACE} port ${APACHE_PORT} -s 0 -A 'tcp[(tcp[12]>>4)*4]=0x47455420' | grep "Content-Length"
```

### Check the Apache configuration file for the maximum allowed request size

```shell
cat /etc/apache2/apache2.conf | grep "LimitRequestBody"
```

### Check the Apache virtual host configuration file for the maximum allowed request size

```shell
cat /etc/apache2/sites-available/${VIRTUAL_HOST_CONFIG_FILE} | grep "LimitRequestBody"
```

### Check the Apache HTTP headers for any information about the request

```shell
curl -I http://localhost:${APACHE_PORT}
```

### Check the Apache access logs for the incoming request details

```shell
tail -n 50 /var/log/apache2/access.log
```


### Increase the maximum allowed size for request payloads in the Apache settings.

```shell

#!/bin/bash

# Set the maximum allowed size for request payloads

${APACHE_CONFIG_FILE_PATH}=/etc/httpd/conf/httpd.conf

${MAXIMUM_PAYLOAD_SIZE}="10MB"

# Backup the original Apache config file

cp ${APACHE_CONFIG_FILE_PATH} ${APACHE_CONFIG_FILE_PATH}.bak

# Update the Apache config file with the new maximum payload size

sed -i 's/^$LimitRequestBody\s*$.*/\1${MAXIMUM_PAYLOAD_SIZE}/' ${APACHE_CONFIG_FILE_PATH}


# Restart Apache to apply the changes

service httpd restart


```


Large Request Payloads in Apache HTTP.

Overview

Parameters

Debug

Check if Apache is running

Check the size of incoming HTTP requests

Check the Apache configuration file for the maximum allowed request size

Check the Apache virtual host configuration file for the maximum allowed request size

Check the Apache HTTP headers for any information about the request

Check the Apache access logs for the incoming request details

Repair

Increase the maximum allowed size for request payloads in the Apache settings.

Learn more

Related Runbooks

Tomcat HTTP Request Headers or Payload Size Exceeds Limits.

Virtual Host Mismatches on Apache Server.

Unauthorized Directory Access in Apache HTTPD.

Slowloris Attack Detected on Apache server.

Support