CVE-2019-10082: apache http_server Use After Free
CVSS: 9.1v3.1CriticalModified
AliasesALPINE-CVE-2019-10082UBUNTU-CVE-2019-10082DEBIAN-CVE-2019-10082
Published 26-09-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-10082 is a critical (CVSS 9.1) Use After Free vulnerability in apache http_server. EPSS estimates a 16.55% chance of exploitation in the next 30 days, higher than 96.9% of scored vulnerabilities.
CVSS score
9.1/10
010
Critical · v3.1 (NVD)EPSS score
16.55%
0%100%
Medium · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 9 · Related 5Timeline
- 26-09-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.
CVSS metrics
5 scores · 4 sources · 2 versionsCritical 9.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Medium 6.4Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:N/A:PSourcesSingle source
EPSS trend
Probability
16.55%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 16.55% on 18-09-2026
18-09-202618-10-2026
EPSS score16.55%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Oracle5 products
- communications_element_manager8.0.0 | 8.1.0 | 8.1.1 | 8.2.0
- enterprise_manager_ops_center12.3.3 | 12.4.0 | 12.4.0.0
- http_server12.2.1.3.0 | 12.2.1.4.0
- instantis_enterprisetrack≥ 17.1, ≤ 17.3
- retail_xstore_point_of_service7.1
Alpine1 product
- apache2< 2.4.41-r0
Apache1 product
- http_server≥ 2.4.18, ≤ 2.4.39
Debian1 product
- apache2< 2.4.41-1
Ubuntu1 product
- apache2< 2.4.29-1ubuntu4.10
5 vendors · 9 products
References
22 links- www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlX Refsource MISCPatchThird Party Advisory
Show all 22 references
- www.oracle.com/security-alerts/cpujul2022.htmlX Refsource MISC
