Description
The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.4.10-1 | — |
| Debian 13 | apache2 | 2.4.10-1 | — |
| Debian 12 | apache2 | 2.4.10-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | apache2 | 2.4.7-1ubuntu4.1 | USN-2299-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | httpd +5 | 2.4.6-18.el7_0 | RHSA-2014:0921 |
| RHEL 7 | mod_ssl +1 | 1:2.4.6-18.el7_0 | RHSA-2014:0921 |
| RHEL 1 | httpd24-httpd +5 | 2.4.6-18.el6 | RHSA-2014:0922 |
| RHEL 1 | httpd24-mod_ssl +1 | 1:2.4.6-18.el6 | RHSA-2014:0922 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.23-4.1 | openSUSE-SU-2024:10268-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | httpd +5 | 2.4.6-18.0.1.el7_0 | ELSA-2014-0921 |
| Oracle Linux 7 | mod_ssl +1 | 1:2.4.6-18.0.1.el7_0 | ELSA-2014-0921 |
Advisories 5
- RHSA-2014:0922 Red Hat Security Advisory: httpd24-httpd security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0921 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- USN-2299-1 apache2 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:10268-1 apache2-2.4.23-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2014-0921 Important: httpd security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 23, 2014
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1120599
- http://advisories.mageia.org/MGASA-2014-0305.html
- https://support.apple.com/HT204659
- http://httpd.apache.org/security/vulnerabilities_24.html
- http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c?r1=1609680&r2=1610674&diff_format=h
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- http://zerodayinitiative.com/advisories/ZDI-14-239/
- http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c
- APPLE-SA-2015-04-08-2 vendor-advisory
- http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c
- 20140722 Apache HTTPd - description of the CVE-2014-0117. mailing-list
- http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=1599486&r2=1610674&diff_format=h
- [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [9/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list