CVE-2010-2068
apache http server: no CVSS score yet. EPSS 16% chance of exploitation in the next 30 days.
mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.
- EPSS
- 16% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:http_server
References
- http://httpd.apache.org/security/vulnerabilities_22.html
- http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
- http://mail-archives.apache.org/mod_mbox/httpd-announce/201006.mbox/%3C4C12933D.4060400%40apache.org%3E
- http://marc.info/?l=apache-announce&m=128009718610929&w=2
- http://secunia.com/advisories/40206