Every CVE Search/ Get API key

CVE-2005-2700

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global...

10.0 HighFix available

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

Exploit likelihood

30.6%Up 23.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 10.0

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

Record
CVE-2005-2700
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Updated
2026-11-02
CVE List No score

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

Record
CVE-2005-2700
Updated
2026-11-02
EUVDEUVD-2005-2701 No score

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

Record
EUVD-2005-2701
Updated
2026-11-03
GitHub AdvisoriesGHSA-6h5v-qgqr-fmq8 No score

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global...

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

Record
GHSA-6h5v-qgqr-fmq8
Updated
2026-11-02
OSV No score

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

Record
CVE-2005-2700
Updated
2026-11-02
OSVDEBIAN-CVE-2005-2700 No score

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

Record
DEBIAN-CVE-2005-2700
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Debian:12
 before 2.0.54-5
2.0.54-5
apache2
Debian:13
 before 2.0.54-5
2.0.54-5
apache2
Debian:14
 before 2.0.54-5
2.0.54-5
apache2
Debian:3.1
 before 2.0.54-5, plus listed versions
2.0.54-4
2.0.54-5
libapache-mod-ssl
Debian:3.0
 before 2.8.9-2.5, plus listed versions
2.4.10-1.3.9-1potato22.4.10-1.3.9-1potato42.8.7-12.8.9-2.4
2.8.9-2.5
libapache-mod-ssl
Debian:3.1
 before 2.8.22-1sarge1, plus listed versions
2.8.22-1
2.8.22-1sarge1
httpd
Red Hat:enterprise_linux:3::as
 before 0:2.0.46-46.3.ent
0:2.0.46-46.3.ent
httpd-debuginfo
Red Hat:enterprise_linux:3::as
 before 0:2.0.46-46.3.ent
0:2.0.46-46.3.ent
httpd-devel
Red Hat:enterprise_linux:3::as
 before 0:2.0.46-46.3.ent
0:2.0.46-46.3.ent
mod_ssl
Red Hat:enterprise_linux:3::as
 before 1:2.0.46-46.3.ent
1:2.0.46-46.3.ent
Show 36 moreShow less
Affected packages
PackageAffectedFixed
httpd
Red Hat:enterprise_linux:3::desktop
 before 0:2.0.46-46.3.ent
0:2.0.46-46.3.ent
httpd-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 0:2.0.46-46.3.ent
0:2.0.46-46.3.ent
httpd-devel
Red Hat:enterprise_linux:3::desktop
 before 0:2.0.46-46.3.ent
0:2.0.46-46.3.ent
mod_ssl
Red Hat:enterprise_linux:3::desktop
 before 1:2.0.46-46.3.ent
1:2.0.46-46.3.ent
httpd
Red Hat:enterprise_linux:3::es
 before 0:2.0.46-46.3.ent
0:2.0.46-46.3.ent
httpd-debuginfo
Red Hat:enterprise_linux:3::es
 before 0:2.0.46-46.3.ent
0:2.0.46-46.3.ent
httpd-devel
Red Hat:enterprise_linux:3::es
 before 0:2.0.46-46.3.ent
0:2.0.46-46.3.ent
mod_ssl
Red Hat:enterprise_linux:3::es
 before 1:2.0.46-46.3.ent
1:2.0.46-46.3.ent
httpd
Red Hat:enterprise_linux:3::ws
 before 0:2.0.46-46.3.ent
0:2.0.46-46.3.ent
httpd-debuginfo
Red Hat:enterprise_linux:3::ws
 before 0:2.0.46-46.3.ent
0:2.0.46-46.3.ent
httpd-devel
Red Hat:enterprise_linux:3::ws
 before 0:2.0.46-46.3.ent
0:2.0.46-46.3.ent
mod_ssl
Red Hat:enterprise_linux:3::ws
 before 1:2.0.46-46.3.ent
1:2.0.46-46.3.ent
httpd
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
httpd-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
httpd-devel
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
httpd-manual
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
httpd-suexec
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
mod_ssl
Red Hat:enterprise_linux:4::as
 before 1:2.0.52-12.2.ent
1:2.0.52-12.2.ent
httpd
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
httpd-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
httpd-devel
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
httpd-manual
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
httpd-suexec
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
mod_ssl
Red Hat:enterprise_linux:4::desktop
 before 1:2.0.52-12.2.ent
1:2.0.52-12.2.ent
httpd
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
httpd-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
httpd-devel
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
httpd-manual
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
httpd-suexec
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
mod_ssl
Red Hat:enterprise_linux:4::es
 before 1:2.0.52-12.2.ent
1:2.0.52-12.2.ent
httpd
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
httpd-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
httpd-devel
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
httpd-manual
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
httpd-suexec
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-12.2.ent
0:2.0.52-12.2.ent
mod_ssl
Red Hat:enterprise_linux:4::ws
 before 1:2.0.52-12.2.ent
1:2.0.52-12.2.ent

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2005-2700 is a high vulnerability (CVSS 10.0) in Apache Http Server, published September 6, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 30.6%, the 98th percentile. Fixed in apache2 2.0.54-5.

References

Show 87 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open