What’s Vulnerable › Vulnerabilities
CVE-2018-1303
- Severity: high (CVSS 7.5 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 69.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-03-26 · updated 2026-06-17
- Weakness: CWE-125
Description
A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.
Affected products
- Apache HTTP Server: through 2.4.29
- Canonical Ubuntu Linux: 14.04, 16.04, 17.10, 18.04
- Debian Linux: 8.0, 9.0
- Clustered Data ONTAP: all versions
- NetApp Santricity Cloud Connector: all versions
- NetApp Storage Automation Store: all versions
- NetApp StorageGRID: all versions
References
- http://www.openwall.com/lists/oss-security/2018/03/24/3
- http://www.securityfocus.com/bid/103522
- http://www.securitytracker.com/id/1040572
- https://access.redhat.com/errata/RHSA-2018:3558
- https://access.redhat.com/errata/RHSA-2019:0366
- https://access.redhat.com/errata/RHSA-2019:0367
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
Get alerted when CVE-2018-1303 or the next vulnerability affects your stack