What’s Vulnerable › Vulnerabilities

CVE-2010-0434

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 18.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2010-03-05 · updated 2026-06-16
• Weakness: CWE-200

Description

The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.

Affected products

• Apache HTTP Server: from 2.0.35 before 2.0.64; from 2.2.0 before 2.2.15 — fixed in 2.0.64, 2.2.15
• Debian Linux: 5.0, 6.0
• Fedoraproject Fedora: 11, 13

How to fix

Upgrade to a fixed version: Apache HTTP Server 2.0.64, 2.2.15. Check the vendor advisory for mitigations.

References

• http://httpd.apache.org/security/vulnerabilities_22.html
• http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html
• http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html
• http://lists.vmware.com/pipermail/security-announce/2010/000105.html
• http://marc.info/?l=bugtraq&m=127557640302499&w=2
• http://secunia.com/advisories/39100
• http://secunia.com/advisories/39115
• http://secunia.com/advisories/39501
• http://secunia.com/advisories/39628
• http://secunia.com/advisories/39632

Get alerted when CVE-2010-0434 or the next vulnerability affects your stack