DEBIAN-CVE-2019-0197

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2019-0197
Published: 11 Jun 2019, 22:29
Last modified:28 Apr 2026, 20:19

Vulnerability Summary

Overall Risk (default)
low
17/100
CVSS Score
4.2 MEDIUM
3.1 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

11 Jun 2019, 22:29
Published
Vulnerability first disclosed
28 Apr 2026, 20:19
Last Modified
Vulnerability information updated

Description

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.

CVSS Metrics

  • v3.1•MEDIUM•Score: 4.2CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Affected Systems

  • debian•apache2

    < 2.4.38-3 | < 2.4.38-3 | < 2.4.38-3 | < 2.4.38-3

References (1)