Description
http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.0.55-4.1 | — |
| Debian 13 | apache2 | 2.0.55-4.1 | — |
| Debian 12 | apache2 | 2.0.55-4.1 | — |
| Debian 3.1 | apache | 1.3.33-6sarge3 | DSA-1167-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | httpd +3 | 2.0.52-28.ent | RHSA-2006:0619 |
| RHEL 4 | mod_ssl | 1:2.0.52-28.ent | RHSA-2006:0619 |
| RHEL 3 | httpd +1 | 2.0.46-61.ent | RHSA-2006:0619 |
| RHEL 3 | mod_ssl | 1:2.0.46-61.ent | RHSA-2006:0619 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Proxy 4 | jabberd | 2.0s10-3.37.rhn | RHSA-2008:0523 |
| Red Hat Network Proxy 4 | rhn-apache | 1.3.27-36.rhn.rhel3 | RHSA-2008:0523 |
| Red Hat Network Proxy 4 | rhn-modperl | 1.29-16.rhel3 | RHSA-2008:0523 |
| Red Hat Certificate System 7 | ant | 1.6.5-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | avalon-logkit | 1.2-2jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | axis | 1.2.1-1jpp_3rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-jaf | 1.0-2jpp_6rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-mail | 1.1.1-2jpp_8rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | geronimo-specs +10 | 1.0-0.M4.1jpp_10rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | jakarta-commons-modeler | 2.0-3jpp_2rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | log4j | 1.2.12-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | mx4j | 1:3.0.1-1jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | pcsc-lite +2 | 1.3.3-3.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-ca | 7.3.0-20.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-java-tools | 7.3.0-10.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-kra | 7.3.0-14.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-manage | 7.3.0-19.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-native-tools | 7.3.0-6.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-tks +1 | 7.3.0-13.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | tomcat5 +5 | 5.5.23-0jpp_4rh.16 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xerces-j2 | 2.7.1-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xml-commons +1 | 1.3.02-2jpp_1rh | RHSA-2010:0602 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Apache 1.3.35/2.0.58/2.2.2 - Arbitrary HTTP Request Headers Security EDB-28424 · remote · Aug 24, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- RHSA-2010:0602 Red Hat Security Advisory: Red Hat Certificate System 7.3 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0523 Red Hat Security Advisory: Red Hat Network Proxy Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2006:0619 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-1167-1 apache - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2010-1572 vdb-entry
- http://svn.apache.org/viewvc?view=rev&revision=394965
- 28749 third-party-advisory
- http://www.f-secure.com/en_EMEA/support/security-advisory/fsc-2010-2.html
- DSA-1167 vendor-advisory
- 19661 vdb-entry
- 21744 third-party-advisory
- 20060724 Write-up by Amit Klein: "Forging HTTP request headers with Flash" mailing-list
- HPSBUX02465 vendor-advisory
- 1024144 vdb-entry
- 22317 third-party-advisory
- 22523 third-party-advisory
- SSRT090208 vendor-advisory
- ADV-2006-5089 vdb-entry
- ADV-2006-3264 vdb-entry
- 20060508 Unfiltered Header Injection in Apache 1.3.34/2.0.57/2.2.1 mailing-list
- 21598 third-party-advisory
- 21399 third-party-advisory
- oval:org.mitre.oval:def:10352 vdb-entry signature
- http://support.avaya.com/elmodocs2/security/ASA-2006-194.htm
- 21478 third-party-advisory
- RHSA-2006:0619 vendor-advisory
- 21986 third-party-advisory
- HPSBUX02612 vendor-advisory
- http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117
- ADV-2006-4207 vdb-entry
- 21848 third-party-advisory
- RHSA-2006:0618 vendor-advisory
- PK24631 vendor-advisory
- SUSE-SA:2008:021 vendor-advisory
- RHSA-2006:0692 vendor-advisory
- 40256 third-party-advisory
- SUSE-SA:2006:051 vendor-advisory
- ADV-2006-2963 vdb-entry
- 21174 third-party-advisory
- USN-575-1 vendor-advisory
- oval:org.mitre.oval:def:12238 vdb-entry signature
- 29640 third-party-advisory
- 1294 third-party-advisory
- [3.9] 012: SECURITY FIX: October 7, 2006 vendor-advisory
- PK27875 vendor-advisory
- 21172 third-party-advisory
- http://kb.vmware.com/KanisaPlatform/Publishing/466/5915871_f.SAL_Public.html
- 1016569 vdb-entry
- ADV-2006-2964 vdb-entry
- 22140 third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [4/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [4/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
- [httpd-cvs] 20210606 svn commit: r1075467 [1/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list