The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Jul 20, 2015 | Jul 20, 2015 |
| Apple Osx Apache | — | Upgrade macOS to the latest versionApply OS X security update 2015-006 | Aug 28, 2015 | Jul 20, 2015 |
| Freebsd | — | Upgrade apache24 | Dec 10, 2025 | Jul 15, 2015 |
| Oracle Solaris | — | Upgrade web/server/apache-22/documentation to version 2.2.31-0.175.3.1.0.3.0 on Solaris 11.3Upgrade web/server/apache-22 to version 2.2.31-0.175.3.1.0.3.0 on Solaris 11.3 | May 29, 2017 | Jul 20, 2015 |
| Suse | — | Upgrade apache2-utilsUpgrade apache2-preforkUpgrade apache2-workerUpgrade apache2-eventUpgrade apache2Upgrade apache2-example-pagesUpgrade apache2-docUpgrade apache2-devel | Dec 9, 2016 | Jul 20, 2015 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub