CVE-2010-0434: apache http_server
Vulnerability summary
CVE-2010-0434 is a medium (CVSS 4.3) vulnerability in apache http_server. EPSS estimates a 18.44% chance of exploitation in the next 30 days, higher than 97.2% of scored vulnerabilities.
Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 1Timeline
- 05-03-2010PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
18.44%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
No change 0.00 pp
From 18.44% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Redhat6 products
- httpd< 0:2.0.52-41.ent.7
- httpd-debuginfo< 0:2.0.52-41.ent.7
- httpd-devel< 0:2.0.52-41.ent.7
- httpd-manual< 0:2.0.52-41.ent.7
- httpd-suexec< 0:2.0.52-41.ent.7
Debian2 products
- apache2< 2.2.15-1
- debian_linuxEOL5.0 | 6.0
Apache1 product
- http_server≥ 2.0.35, < 2.0.64 | ≥ 2.2.0, < 2.2.15
Fedoraproject1 product
- fedoraEOL11 | 13
4 vendors · 10 products
References
69 links- www.redhat.com/support/errata/RHSA-2010-0175.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
- www-01.ibm.com/support/docview.wss?uid=swg1PM12247Vendor AdvisoryX Refsource AIXAPARThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
Show all 69 references
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10358VDB EntrySignatureX Refsource OVALThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8695VDB EntrySignatureX Refsource OVALThird Party Advisory
- marc.info?l=bugtraq&m=127557640302499&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
- www-01.ibm.com/support/docview.wss?uid=swg1PM15829Vendor AdvisoryX Refsource AIXAPARThird Party Advisory
- www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.htmlX Refsource CONFIRMThird Party Advisory
- www.redhat.com/support/errata/RHSA-2010-0168.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
- lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlVendor AdvisoryX Refsource APPLEBroken LinkMailing List
- lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.vmware.com/pipermail/security-announce/2010/000105.htmlMailing ListX Refsource MLISTThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=570171X Refsource CONFIRMIssue TrackingThird Party AdvisoryREPORT
- www-01.ibm.com/support/docview.wss?uid=swg1PM08939Vendor AdvisoryX Refsource AIXAPARThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
