What’s Vulnerable › Vulnerabilities

CVE-2019-0197

• Severity: medium (CVSS 4.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 8.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-06-11 · updated 2026-06-17
• Weakness: CWE-444

Description

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.

Affected products

• Apache HTTP Server: from 2.4.34 through 2.4.38
• Canonical Ubuntu Linux: 16.04, 18.04, 19.04
• Fedoraproject Fedora: 30
• openSUSE Leap: 15.0, 42.3
• Oracle Communications Session Report Manager: 8.0.0, 8.1.0, 8.1.1, 8.2.0
• Oracle Communications Session Route Manager: 8.0.0, 8.1.0, 8.1.1, 8.2.0
• Oracle Corporation Enterprise Manager Ops Center: 12.3.3, 12.4.0
• Oracle Corporation Oracle HTTP Server: 12.2.1.3.0
• Oracle Instantis Enterprisetrack: 17.1, 17.2, 17.3
• Oracle Corporation Retail Xstore Point of Service: 7.0, 7.1
• RedHat Jboss Core Services: 1.0

References

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html
• http://www.openwall.com/lists/oss-security/2019/04/02/2
• http://www.securityfocus.com/bid/107665
• https://access.redhat.com/errata/RHSA-2019:3932
• https://access.redhat.com/errata/RHSA-2019:3933
• https://access.redhat.com/errata/RHSA-2019:3935
• https://httpd.apache.org/security/vulnerabilities_24.html
• https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/e0b8f6e858b1c8ec2ce8e291a2c543d438915037c7af661ab6d33808%40%3Cdev.httpd.apache.org%3E

Get alerted when CVE-2019-0197 or the next vulnerability affects your stack