What’s Vulnerable › Vulnerabilities

CVE-2019-0196

• Severity: medium (CVSS 5.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 20.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-06-11 · updated 2026-06-17
• Weakness: CWE-416

Description

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.

Affected products

• Apache HTTP Server: from 2.4.17 through 2.4.38
• Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 18.10
• Debian Linux: 9.0

References

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html
• http://www.apache.org/dist/httpd/CHANGES_2.4.39
• http://www.openwall.com/lists/oss-security/2019/04/02/1
• http://www.securityfocus.com/bid/107669
• https://access.redhat.com/errata/RHSA-2019:3932
• https://access.redhat.com/errata/RHSA-2019:3933
• https://access.redhat.com/errata/RHSA-2019:3935
• https://httpd.apache.org/security/vulnerabilities_24.html
• https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E

Get alerted when CVE-2019-0196 or the next vulnerability affects your stack