In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by en

Summary

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.

Timeline

1. Sep 25, 2019, 4:39 PM UTCCVE published
2. Oct 14, 2019Public exploit on Exploit-DB

   EDB-47689

3. Aug 4, 2024, 10:10 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a Apache HTTP Server

  2.4.0 to 2.4.39

References 19