What’s Vulnerable › Vulnerabilities

CVE-2004-0493

• Severity: medium (CVSS 6.4 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 84.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2004-08-06 · updated 2026-06-16

Description

The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.

Affected products

• Apache HTTP Server: 2.0.47, 2.0.48, 2.0.49
• Avaya Converged Communications Server: 2.0
• Avaya S8300: r2.0.0
• Avaya S8500: r2.0.0
• Avaya S8700: r2.0.0
• gentoo Linux: 1.4
• IBM HTTP Server: 2.0.42, 2.0.42.1, 2.0.42.2, 2.0.47, 2.0.47.1
• Trustix Secure Linux: 1.5, 2.0, 2.1

References

• http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/023133.html
• http://marc.info/?l=bugtraq&m=108853066800184&w=2
• http://marc.info/?l=bugtraq&m=109181600614477&w=2
• http://security.gentoo.org/glsa/glsa-200407-03.xml
• http://www.apacheweek.com/features/security-20
• http://www.guninski.com/httpd1.html
• http://www.mandriva.com/security/advisories?name=MDKSA-2004:064
• http://www.redhat.com/support/errata/RHSA-2004-342.html
• http://www.securityfocus.com/bid/10619
• http://www.trustix.org/errata/2004/0039/
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16524
• https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E

Get alerted when CVE-2004-0493 or the next vulnerability affects your stack