Description
A flaw was found in the mod_fcgid module of httpd. A malformed FastCGI response may result in a stack-based buffer overflow in the modules/fcgid/fcgid_bucket.c file in the fcgid_header_bucket_read() function, resulting in an application crash.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | mod_fcgid | — | 2.3.6 |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Fedora | Fedora | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libapache2-mod-fcgid | 1:2.3.6-1 | — |
| Debian 13 | libapache2-mod-fcgid | 1:2.3.6-1 | — |
| Debian 12 | libapache2-mod-fcgid | 1:2.3.6-1 | — |
| Debian 5.0 | libapache2-mod-fcgid | 1:2.2-1+lenny1 | DSA-2140-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2-mod_fcgid | 2.3.9-7.3 | openSUSE-SU-2024:10564-1 |
Advisories 2
- DSA-2140-1 libapache2-mod-fcgid - stack overflow Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10564-1 apache2-mod_fcgid-2.3.9-7.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- FEDORA-2010-17474 vendor-advisory
- FEDORA-2010-17434 vendor-advisory
- FEDORA-2010-17472 vendor-advisory
- openSUSE-SU-2011:0884 vendor-advisory
- SUSE-SU-2011:0885 vendor-advisory
- 69275 vdb-entry
- 42288 third-party-advisory
- 42302 third-party-advisory
- 42815 third-party-advisory
- DSA-2140 vendor-advisory
- [apache] 20101107 [ANNOUNCE] mod_fcgid 2.3.6 is released mailing-list
- 44900 vdb-entry
- ADV-2010-2997 vdb-entry
- ADV-2010-2998 vdb-entry
- ADV-2011-0031 vdb-entry
- https://access.redhat.com/security/cve/CVE-2010-3872 vdb-entry
- RHBZ#2248172 issue-tracking
- apache-fcgid-bo(63303) vdb-entry
- https://github.com/apache/httpd-mod_fcgid/commit/b1afa70840b4ab4e6fbc12ac8798b2f3ccc336b2
- https://issues.apache.org/bugzilla/show_bug.cgi?id=49406