CVE-2014-0117

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 35.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-07-20 · updated 2026-06-17
Weakness: CWE-20

Description

The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.

Affected products

Apache HTTP Server: 2.4.6, 2.4.7, 2.4.8, 2.4.9
macOS: through 10.10.2

References

http://advisories.mageia.org/MGASA-2014-0305.html
http://httpd.apache.org/security/vulnerabilities_24.html
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
http://seclists.org/fulldisclosure/2014/Jul/117
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=1599486&r2=1610674&diff_format=h
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c?r1=1609680&r2=1610674&diff_format=h
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://zerodayinitiative.com/advisories/ZDI-14-239/
https://bugzilla.redhat.com/show_bug.cgi?id=1120599
https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E

Get alerted when CVE-2014-0117 or the next vulnerability affects your stack