Skip to content
OpenAdvisories
High DSA-4509-1 5 CVEs

apache2 - security update

Published Aug 26, 2019 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 10 apache2 2.4.38-3+deb10u1
Debian · 9 apache2 2.4.25-3+deb9u8

Vulnerabilities 5

  • High 7.5
    CVE-2019-9517 EPSS 27%

    Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer…

    apache2 apache2 nodejs apache2 Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-10081 EPSS 14%

    HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwr…

    apache2 apache2 apache2 Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-10082 EPSS 17%

    In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memo…

    apache2 apache2 apache2 Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-10092 Public exploit Scanner template EPSS 81%

    In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error pag…

    apache2 apache2 apache2 Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-10098 Public exploit Scanner template EPSS 74%

    In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential …

    apache2 apache2 apache2 Debian Ubuntu Alpine