CVE-2019-0196
A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.
Timeline
- CVE published
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Apache Software Foundation Apache HTTP Server
2.4.17 to 2.4.38
References 25
httpd.apache.org
openwall.com
securityfocus.com
seclists.org
usn.ubuntu.com
lists.fedoraproject.org
debian.org
apache.org
lists.opensuse.org
support.f5.com
lists.apache.org
- thread.html/fd110f4ace2d8364c7d9190e1993cde92f79e4eb85576ed9285686ac@<cvs.httpd.apache.org>
- thread.html/97a1c58e138ed58a364513b58d807a802e72bf6079ff81a10948ef7c@<cvs.httpd.apache.org>
- thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@<cvs.httpd.apache.org>
- thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@<cvs.httpd.apache.org>