CVE-2015-0253: apache http_server
Vulnerability summary
CVE-2015-0253 is a medium (CVSS 5.0) vulnerability in apache http_server. EPSS estimates a 12.89% chance of exploitation in the next 30 days, higher than 96.3% of scored vulnerabilities.
Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 20-07-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
12.89%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
Decrease -0.09 pp
From 12.97% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Apple2 products
- mac_os_x10.10.4
- mac_os_x_server5.0.3
Apache1 product
- http_server2.4.12
3 vendors · 5 products
References
27 links- github.com/apache/httpd/commit/6a974059190b8a0c7e499f4ab12fe108127099cbX Refsource CONFIRM
- www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlX Refsource CONFIRMThird Party Advisory
- lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlVendor AdvisoryX Refsource APPLEMailing List
Show all 27 references
- lists.apple.com/archives/security-announce/2015/Sep/msg00004.htmlVendor AdvisoryX Refsource APPLEMailing List
- www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlX Refsource CONFIRMThird Party Advisory
- github.com/apache/httpd/commit/be0f5335e3e73eb63253b050fdc23f252f5c8ae3X Refsource CONFIRM