CVE-2019-0197: apache software foundation apache http server
Vulnerability summary
CVE-2019-0197 is a medium (CVSS 4.9) vulnerability in apache software foundation apache http server. EPSS estimates a 8.59% chance of exploitation in the next 30 days, higher than 95% of scored vulnerabilities.
Not severe (CVSS 4.2, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8 · Related 4Timeline
- 11-06-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated4.2MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
- OSV · UbuntuEcosystem advisory · calculated4.2MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
- OSV · DebianEcosystem advisory · calculated4.2MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS trend
Probability
8.59%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
No change 0.00 pp
From 8.59% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Oracle6 products
- communications_session_report_manager8.0.0 | 8.1.0 | 8.1.1 | 8.2.0
- communications_session_route_manager8.0.0 | 8.1.0 | 8.1.1 | 8.2.0
- enterprise_manager_ops_center12.3.3 | 12.4.0
- http_server12.2.1.3.0
- instantis_enterprisetrack17.1 | 17.2 | 17.3
Alpine1 product
- apache2< 2.4.39-r0
Apache1 product
- http_server≥ 2.4.34, ≤ 2.4.38
Apache software foundation1 product
- apache http server2.4.34 to 2.4.38
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 19.04
Debian1 product
- apache2< 2.4.38-3
Fedoraproject1 product
- fedoraEOL30
Opensuse1 product
- leapEOL15.0 | 42.3
Redhat1 product
Ubuntu1 product
- apache2< 2.4.29-1ubuntu4.10
10 vendors · 15 products
References
36 links- lists.apache.org/thread.html/…X Refsource MISC
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.htmlVendor AdvisoryX Refsource SUSEMailing ListPatchThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.htmlVendor AdvisoryX Refsource SUSEMailing ListPatchThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.htmlVendor AdvisoryX Refsource SUSEMailing ListPatchThird Party Advisory
Show all 36 references
- www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlX Refsource MISCPatchThird Party Advisory
- support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_usX Refsource CONFIRMThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlX Refsource MISCPatchThird Party Advisory
