A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38.

Summary

A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.

Timeline

1. Jun 11, 2019, 8:49 PM UTCCVE published
2. Aug 4, 2024, 5:44 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache HTTP Server

  2.4.0 to 2.4.38

References 25