CVE-2003-0016

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 17.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2003-02-07 · updated 2026-06-16

Description

Apache before 2.0.44, when running on unpatched Windows 9x and Me operating systems, allows remote attackers to cause a denial of service or execute arbitrary code via an HTTP request containing MS-DOS device names.

Affected products

Apache HTTP Server: 2.0.36, 2.0.37, 2.0.38, 2.0.39, 2.0.40, 2.0.41 (+2)

References

http://marc.info/?l=apache-httpd-announce&m=104313442901017&w=2
http://www.apacheweek.com/issues/03-01-24#security
http://www.kb.cert.org/vuls/id/825177
http://www.kb.cert.org/vuls/id/979793
http://www.securityfocus.com/bid/6659
https://exchange.xforce.ibmcloud.com/vulnerabilities/11124
https://exchange.xforce.ibmcloud.com/vulnerabilities/11125
https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3E

Get alerted when CVE-2003-0016 or the next vulnerability affects your stack