What’s Vulnerable › Vulnerabilities

CVE-2014-3583

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 10.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-12-15 · updated 2026-06-17
• Weakness: CWE-119

Description

The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.

Affected products

• Apache HTTP Server: 2.4.10
• macOS: 10.9.5, 10.10.0, 10.10.1, 10.10.2, 10.10.3, 10.10.4
• Apple Os X Server: 5.0.3
• Canonical Ubuntu Linux: 10.04, 12.04, 14.04, 14.10

References

• http://httpd.apache.org/security/vulnerabilities_24.html
• http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html
• http://rhn.redhat.com/errata/RHSA-2015-1855.html
• http://svn.apache.org/viewvc?view=revision&revision=1638818
• http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
• http://www.securityfocus.com/bid/71657
• http://www.ubuntu.com/usn/USN-2523-1
• https://access.redhat.com/errata/RHSA-2015:1858
• https://bugzilla.redhat.com/show_bug.cgi?id=1163555
• https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E

Get alerted when CVE-2014-3583 or the next vulnerability affects your stack