The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not…

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Advisories 4

• RHSA-2010:0602 Red Hat Security Advisory: Red Hat Certificate System 7.3 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
• RHSA-2008:0967 Red Hat Security Advisory: httpd security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
• RHSA-2008:0966 Red Hat Security Advisory: Red Hat Application Stack v2.2 security and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
• openSUSE-SU-2024:10623-1 apache2-2.4.49-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026

References

• SUSE-SR:2009:007 vendor-advisory
• 34259 third-party-advisory
• 34219 third-party-advisory
• oval:org.mitre.oval:def:11713 vdb-entry signature
• 31026 third-party-advisory
• HPSBUX02465 vendor-advisory
• 31651 third-party-advisory
• 247666 vendor-advisory
• 31681 vdb-entry
• 32838 third-party-advisory
• 20081122 rPSA-2008-0328-1 httpd mod_ssl mailing-list
• 31904 third-party-advisory
• http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
• RHSA-2008:0967 vendor-advisory
• 29653 vdb-entry
• 34418 third-party-advisory
• 30621 third-party-advisory
• 32685 third-party-advisory
• apache-modproxy-module-dos(42987) vdb-entry
• SUSE-SR:2009:006 vendor-advisory
• 31416 third-party-advisory
• 1020267 vdb-entry
• http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=666154&r2=666153&pathrev=666154
• USN-731-1 vendor-advisory
• ADV-2009-0320 vdb-entry
• HPSBUX02365 vendor-advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg27008517
• oval:org.mitre.oval:def:9577 vdb-entry signature
• 32222 third-party-advisory
• oval:org.mitre.oval:def:6084 vdb-entry signature
• RHSA-2008:0966 vendor-advisory
• 33156 third-party-advisory
• 33797 third-party-advisory
• 20080729 rPSA-2008-0236-1 httpd mod_ssl mailing-list
• 31404 third-party-advisory
• FEDORA-2008-6393 vendor-advisory
• GLSA-200807-06 vendor-advisory
• ADV-2008-2780 vdb-entry
• HPSBUX02401 vendor-advisory
• MDVSA-2008:237 vendor-advisory
• FEDORA-2008-6314 vendor-advisory
• ADV-2008-1798 vdb-entry
• APPLE-SA-2008-10-09 vendor-advisory
• http://support.apple.com/kb/HT3216
• MDVSA-2008:195 vendor-advisory
• PK67579 vendor-advisory
• http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0328
• [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
• [httpd-cvs] 20210330 svn commit: r1888194 [5/13] - /httpd/site/trunk/content/security/json/ mailing-list
• [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
• [httpd-cvs] 20210330 svn commit: r1073139 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
• [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list