CVSS 3.1
7.2 highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCVE-2019-10097
In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.
Severity
- EPSS
- 53% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-476, CWE-787
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:http_server
- oracle:communications_element_manager
- oracle:communications_session_report_manager
- oracle:communications_session_route_manager
- oracle:enterprise_manager_ops_center
- oracle:http_server
- oracle:instantis_enterprisetrack
- oracle:retail_xstore_point_of_service
References
- https://access.redhat.com/errata/RHSA-2019:4126
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E