CVE-2019-10097: apache http_server NULL Pointer Dereference
Vulnerability summary
CVE-2019-10097 is a high (CVSS 7.2) NULL Pointer Dereference vulnerability in apache http_server. EPSS estimates a 52.87% chance of exploitation in the next 30 days, higher than 98.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Related 3Timeline
- 26-09-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
52.87%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 52.87% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Oracle7 products
- communications_element_manager8.0.0 | 8.1.0 | 8.1.1 | 8.2.0
- communications_session_report_manager8.1.1 | 8.2.0 | 8.2.1
- communications_session_route_manager8.1.1 | 8.2.0 | 8.2.1
- enterprise_manager_ops_center12.3.3 | 12.4.0
- http_server12.2.1.4.0
Alpine1 product
- apache2< 2.4.41-r0
Apache1 product
- http_server2.4.33 | 2.4.34 | 2.4.35 | 2.4.37 | 2.4.38
Debian1 product
- apache2< 2.4.41-1
4 vendors · 10 products
References
19 links- www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlX Refsource MISCThird Party Advisory
