CVE-2019-10082

9.1 criticalEPSS 17%

Critical (9.1). EPSS 17% chance of exploitation in the next 30 days.

In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS: 17% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE: CWE-416
Published: 2019-09-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:http_server
oracle:communications_element_manager
oracle:enterprise_manager_ops_center
oracle:http_server
oracle:instantis_enterprisetrack
oracle:retail_xstore_point_of_service

References

https://httpd.apache.org/security/vulnerabilities_24.html
https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E

Check your stack JSON