9.8

CVE-2009-3555: apache http_server Improper Certificate Validation

Modified
AliasesRHSA-2010:0155RHSA-2010:0164RHSA-2010:0165
Published 09-11-2009Last modified 27-05-2026

Vulnerability summary

CVE-2009-3555 is a critical (CVSS 9.8) Improper Certificate Validation vulnerability in apache http_server. EPSS estimates a 87.26% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 5 public exploits are recorded.

Priority
Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 21-12-2009)

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
87.26%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits5reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 33 · Related 4
DLA-400-1DSA-1934-1DSA-2141-1DSA-2626-1DSA-3253-1OPENSUSE-SU-2024:10071-1

Timeline

  1. 09-11-2009
    PublishedVulnerability first disclosed.
  2. 27-05-2026
    Last modifiedVulnerability information updated.

Description

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

87.26%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 87.26% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

5 found
  • referenceUnverified

    Exploit Reference (securityfocus.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (xss.cx)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (clicky.me)

    Maturity: unknown

Show all 5 exploits
  • exploit-databaseremotemultipleVerified

    Mozilla NSS - NULL Character CA SSL Certificate Validation Security Bypass

    Maturity: weaponized

  • exploit-databaseremotemultipleVerified

    TLS - Renegotiation

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat17 products
  • java-1.4.2-ibm< 0:1.4.2.13.4-1jpp.1.el3 | < 0:1.4.2.13.4-1jpp.1.el4 | < 0:1.4.2.13.4-1jpp.1.el5
  • java-1.4.2-ibm-demo< 0:1.4.2.13.4-1jpp.1.el3 | < 0:1.4.2.13.4-1jpp.1.el4 | < 0:1.4.2.13.4-1jpp.1.el5
  • java-1.4.2-ibm-devel< 0:1.4.2.13.4-1jpp.1.el3 | < 0:1.4.2.13.4-1jpp.1.el4 | < 0:1.4.2.13.4-1jpp.1.el5
  • java-1.4.2-ibm-javacomm< 0:1.4.2.13.4-1jpp.1.el4 | < 0:1.4.2.13.4-1jpp.1.el5
  • java-1.4.2-ibm-jdbc< 0:1.4.2.13.4-1jpp.1.el3 | < 0:1.4.2.13.4-1jpp.1.el4 | < 0:1.4.2.13.4-1jpp.1.el5
Debian8 products
  • apache2< 2.2.14-2
  • lighttpd< 1.4.30-1
  • nginx< 0.7.64-1
  • nss< 3.12.3.1-0lenny3 | < 3.12.6-1
  • openssl< 0.9.8k-6
Apache1 product
Canonical1 product
F51 product
  • nginx≥ 0.1.0, ≤ 0.8.22
Fedoraproject1 product
Gnu1 product
Mozilla1 product
Openssl1 product
Org.apache.tomcat1 product
  • tomcat≥ 7.0.0, < 7.0.10 | ≥ 6.0.0, < 6.0.32 | ≥ 5.0.0, < 5.5.33

10 vendors · 33 products

References

361 links
Show all 100 references

Showing 100 of 361.