CVE-2016-5387

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 55.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-07-19 · updated 2026-06-17

Description

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.

Affected products

Apache HTTP Server: from 2.2.0 through 2.2.31; from 2.4.1 through 2.4.23
Canonical Ubuntu Linux: 12.04, 14.04, 15.10, 16.04
Debian Linux: 8.0
Fedoraproject Fedora: 23, 24
Hewlett Packard Enterprise System Management Homepage for Windows and Linux: through 7.5.5.0
openSUSE Leap: 42.1
Opensuse: 13.2
Oracle Communications User Data Repository: from 10.0.0 through 12.4
Oracle Corporation Enterprise Manager Ops Center: 12.2.2, 12.3.2
Oracle Corporation Oracle Linux: 5, 6, 7
Oracle Corporation Solaris Operating System: 11.3
RedHat Enterprise Linux Desktop: 6.0, 7.0
RedHat Enterprise Linux Eus: 7.2, 7.3, 7.4, 7.5, 7.6, 7.7
RedHat Enterprise Linux Server: 6.0, 7.0
RedHat Enterprise Linux Server Aus: 7.2, 7.3, 7.4, 7.6, 7.7
RedHat Enterprise Linux Server Tus: 7.2, 7.3, 7.6, 7.7
RedHat Enterprise Linux Workstation: 6.0, 7.0
RedHat Jboss Core Services: 1.0
Red Hat JBoss Enterprise Web Server: 2.0.0, 3.0.0
RedHat Jboss Web Server: 2.1.0

References

Get alerted when CVE-2016-5387 or the next vulnerability affects your stack