CVE-2019-0211: In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or

Summary

Apache HTTP Server, a widely used web server, is affected when running its event, worker, or prefork process models on Unix-like systems. A local attacker who can run code in less-privileged child processes or threads, such as scripts run by an embedded interpreter, could gain the ability to execute arbitrary code with the higher privileges of the parent process, typically root.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

Timeline

Apr 8, 2019, 9:31 PM UTCCVE published
Nov 3, 2021Added to CISA KEV
CISA has evidence of exploitation in the wild
May 3, 2022CISA remediation deadline
Due date for US federal agencies to patch
Oct 21, 2025, 11:45 PM UTCRecord last updated
Oct 22, 2026EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days