What’s Vulnerable › Vulnerabilities

CVE-2019-0220

• Severity: medium (CVSS 5.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 18.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-06-11 · updated 2026-06-17
• Weakness: CWE-706

Description

A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.

Affected products

• Apache HTTP Server: from 2.4.0 through 2.4.38
• Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 18.10
• Debian Linux: 8.0, 9.0
• Fedoraproject Fedora: 28, 29, 30
• openSUSE Leap: 15.0, 42.3

References

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html
• http://www.openwall.com/lists/oss-security/2019/04/02/6
• http://www.securityfocus.com/bid/107670
• https://access.redhat.com/errata/RHSA-2019:2343
• https://access.redhat.com/errata/RHSA-2019:3436
• https://access.redhat.com/errata/RHSA-2019:4126
• https://access.redhat.com/errata/RHSA-2020:0250
• https://access.redhat.com/errata/RHSA-2020:0251
• https://httpd.apache.org/security/vulnerabilities_24.html
• https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E

Get alerted when CVE-2019-0220 or the next vulnerability affects your stack