CVE-2009-1191
mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote...
mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
Exploit likelihood
What each source reports
NVD Score used
mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
- Record
CVE-2009-1191- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
- Record
CVE-2009-1191- Updated
- 2026-11-02
EUVDEUVD-2009-1190 No score
mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
- Record
EUVD-2009-1190- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h7v8-q79w-9jq6 No score
mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote...
mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
- Record
GHSA-h7v8-q79w-9jq6- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
- Record
CVE-2009-1191- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-1191 No score
mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
- Record
DEBIAN-CVE-2009-1191- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10268-1 No score
apache2-2.4.23-4.1 on GA media
These are all security issues fixed in the apache2-2.4.23-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10268-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache2Debian:12 |
before 2.2.11-4 | 2.2.11-4 |
apache2Debian:13 |
before 2.2.11-4 | 2.2.11-4 |
apache2Debian:14 |
before 2.2.11-4 | 2.2.11-4 |
httpd22Red Hat:jboss_enterprise_web_server:1::el4 |
before 0:2.2.10-16.1.ep5.el4 | 0:2.2.10-16.1.ep5.el4 |
httpd22-aprRed Hat:jboss_enterprise_web_server:1::el4 |
before 0:2.2.10-16.1.ep5.el4 | 0:2.2.10-16.1.ep5.el4 |
httpd22-apr-develRed Hat:jboss_enterprise_web_server:1::el4 |
before 0:2.2.10-16.1.ep5.el4 | 0:2.2.10-16.1.ep5.el4 |
httpd22-apr-utilRed Hat:jboss_enterprise_web_server:1::el4 |
before 0:2.2.10-16.1.ep5.el4 | 0:2.2.10-16.1.ep5.el4 |
httpd22-apr-util-develRed Hat:jboss_enterprise_web_server:1::el4 |
before 0:2.2.10-16.1.ep5.el4 | 0:2.2.10-16.1.ep5.el4 |
httpd22-debuginfoRed Hat:jboss_enterprise_web_server:1::el4 |
before 0:2.2.10-16.1.ep5.el4 | 0:2.2.10-16.1.ep5.el4 |
httpd22-develRed Hat:jboss_enterprise_web_server:1::el4 |
before 0:2.2.10-16.1.ep5.el4 | 0:2.2.10-16.1.ep5.el4 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mod_ssl22Red Hat:jboss_enterprise_web_server:1::el4 |
before 1:2.2.10-16.1.ep5.el4 | 1:2.2.10-16.1.ep5.el4 |
httpdRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:2.2.10-4.ep5.el5 | 0:2.2.10-4.ep5.el5 |
httpd-develRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:2.2.10-4.ep5.el5 | 0:2.2.10-4.ep5.el5 |
httpd-manualRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:2.2.10-4.ep5.el5 | 0:2.2.10-4.ep5.el5 |
mod_sslRed Hat:jboss_enterprise_web_server:1::el5 |
before 1:2.2.10-4.ep5.el5 | 1:2.2.10-4.ep5.el5 |
apache2openSUSE:Tumbleweed From an advisory covering 48 CVEs |
before 2.4.23-4.1 | 2.4.23-4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-1191 is a medium vulnerability (CVSS 5.0) in Apache Http Server, published April 23, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.4%, the 96th percentile. Fixed in apache2 2.2.11-4.
References
securityfocus.com/bid/34663
apache.org/dist/httpd/patches/apply_to_2.2.11/PR46949.diff
secunia.com/advisories/35395
exchange.xforce.ibmcloud.com/vulnerabilities/50059
mandriva.com/security/advisories?name=MDVSA-2009:102
oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
Show 97 moreShow less
vupen.com/english/advisories/2009/1147
security.gentoo.org/glsa/glsa-200907-04.xml
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8261
osvdb.org/53921
securitytracker.com/id?1022264
issues.apache.org/bugzilla/show_bug.cgi?id=46949
lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=766938&r2=767089
support.apple.com/kb/HT3937
ubuntu.com/usn/usn-787-1
lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2009-1191
github.com/advisories/GHSA-h7v8-q79w-9jq6
security-tracker.debian.org/tracker/CVE-2009-1191
access.redhat.com/errata/RHSA-2009:1058
bugzilla.redhat.com/show_bug.cgi?id=496801
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1058.json
cve.org/CVERecord?id=CVE-2009-1191
suse.com/security/cve/CVE-2009-0023