CVE-2019-10081: apache http_server Out-of-bounds Write
Vulnerability summary
CVE-2019-10081 is a high (CVSS 7.5) Out-of-bounds Write vulnerability in apache http_server. EPSS estimates a 14.56% chance of exploitation in the next 30 days, higher than 96.6% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 9 · Related 5Timeline
- 15-08-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
14.56%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 14.56% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (httpd.apache.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- apache2< 2.4.41-1
- debian_linuxEOL9.0 | 10.0
Alpine1 product
- apache2< 2.4.41-r0
Apache1 product
- http_server≥ 2.4.20, ≤ 2.4.39
Ubuntu1 product
- apache2< 2.4.29-1ubuntu4.10
4 vendors · 5 products
References
27 links
- www.oracle.com/security-alerts/cpuapr2020.htmlX Refsource MISC
- www.oracle.com/security-alerts/cpujul2020.htmlX Refsource MISC
Show all 27 references
- security.netapp.com/advisory/ntap-20190905-0003/X Refsource CONFIRM