Every CVE Search/ Get API key

CVE-2014-0098

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP...

5.0 MediumFix available

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.

Exploit likelihood

26.7%Up 19.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.

Record
CVE-2014-0098
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated
2026-11-02
CVE List No score

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.

Record
CVE-2014-0098
Updated
2026-11-02
EUVDEUVD-2014-0179 No score

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.

Record
EUVD-2014-0179
Updated
2026-11-03
GitHub AdvisoriesGHSA-mfxf-5vhj-623g No score

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP...

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.

Record
GHSA-mfxf-5vhj-623g
Weakness
CWE-20
Updated
2026-11-02
OSVBELL-CVE-2014-0098 5.0

CVE-2014-0098 does not affect BellSoft software

Record
BELL-CVE-2014-0098
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated
2026-11-02
OSV No score

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.

Record
CVE-2014-0098
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2014-0098 No score

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.

Record
DEBIAN-CVE-2014-0098
Updated
2026-11-02
OSVMGASA-2014-0135 No score

Updated apache packages fix security vulnerabilities

Apache HTTPD before 2.4.9 was vulnerable to a denial of service in mod_dav when handling DAV_WRITE requests (CVE-2013-6438).

Apache HTTPD before 2.4.9 was vulnerable to a denial of service when logging cookies (CVE-2014-0098).

Record
MGASA-2014-0135
Updated
2026-11-02
OSVopenSUSE-SU-2024:10268-1 No score

apache2-2.4.23-4.1 on GA media

These are all security issues fixed in the apache2-2.4.23-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10268-1
Updated
2026-11-02
OSVSUSE-SU-2015:0689-1 No score

Recommended update for apache2

This update for the Apache Web Server introduces directives to control two protocol options:

* HttpContentLengthHeadZero: Allow responses to HEAD request with
  Content-Length of 0
* HttpExpectStrict: Allow the administrator to control whether clients
  must send '100-continue'

MODULE_MAGIC_NUMBER_MINOR has been increased to 24, as this change is not forward-compatible. Modules built against this release might not work correctly with older releases of the Apache Web Server.

Record
SUSE-SU-2015:0689-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Debian:12
 before 2.4.9-1
2.4.9-1
apache2
Debian:13
 before 2.4.9-1
2.4.9-1
apache2
Debian:14
 before 2.4.9-1
2.4.9-1
apache
Mageia:3
From an advisory covering 2 CVEs
 before 2.4.4-7.6.mga3
2.4.4-7.6.mga3
apache
Mageia:4
From an advisory covering 2 CVEs
 before 2.4.7-5.1.mga4
2.4.7-5.1.mga4
httpd
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
httpd-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
mod_ssl
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 1:2.2.3-85.el5_10
1:2.2.3-85.el5_10
httpd
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 2 CVEs
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
httpd-debuginfo
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 2 CVEs
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
Show 53 moreShow less
Affected packages
PackageAffectedFixed
httpd-devel
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 2 CVEs
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
httpd-manual
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 2 CVEs
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
httpd
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
httpd-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
httpd-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
httpd-manual
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:2.2.3-85.el5_10
0:2.2.3-85.el5_10
mod_ssl
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 1:2.2.3-85.el5_10
1:2.2.3-85.el5_10
httpd
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-tools
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-manual
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
mod_ssl
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 1:2.2.15-30.el6_5
1:2.2.15-30.el6_5
httpd
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-tools
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-manual
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
mod_ssl
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 1:2.2.15-30.el6_5
1:2.2.15-30.el6_5
httpd
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-manual
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-tools
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
mod_ssl
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 1:2.2.15-30.el6_5
1:2.2.15-30.el6_5
httpd
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-manual
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
httpd-tools
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:2.2.15-30.el6_5
0:2.2.15-30.el6_5
mod_ssl
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 1:2.2.15-30.el6_5
1:2.2.15-30.el6_5
httpd
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 2 CVEs
 before 0:2.2.22-27.ep6.el5
0:2.2.22-27.ep6.el5
httpd-devel
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 2 CVEs
 before 0:2.2.22-27.ep6.el5
0:2.2.22-27.ep6.el5
httpd-manual
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 2 CVEs
 before 0:2.2.22-27.ep6.el5
0:2.2.22-27.ep6.el5
httpd-tools
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 2 CVEs
 before 0:2.2.22-27.ep6.el5
0:2.2.22-27.ep6.el5
mod_ssl
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 2 CVEs
 before 1:2.2.22-27.ep6.el5
1:2.2.22-27.ep6.el5
httpd
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 2 CVEs
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
httpd-debuginfo
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 2 CVEs
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
httpd-devel
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 2 CVEs
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
httpd-manual
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 2 CVEs
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
httpd-tools
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 2 CVEs
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
mod_ssl
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 2 CVEs
 before 1:2.2.22-27.ep6.el6
1:2.2.22-27.ep6.el6
httpd
Red Hat:jboss_enterprise_application_platform:6::el5
From an advisory covering 2 CVEs
 before 0:2.2.22-27.ep6.el5
0:2.2.22-27.ep6.el5
httpd-debuginfo
Red Hat:jboss_enterprise_application_platform:6::el5
From an advisory covering 2 CVEs
 before 0:2.2.22-27.ep6.el5
0:2.2.22-27.ep6.el5
httpd-devel
Red Hat:jboss_enterprise_application_platform:6::el5
From an advisory covering 2 CVEs
 before 0:2.2.22-27.ep6.el5
0:2.2.22-27.ep6.el5
httpd-tools
Red Hat:jboss_enterprise_application_platform:6::el5
From an advisory covering 2 CVEs
 before 0:2.2.22-27.ep6.el5
0:2.2.22-27.ep6.el5
mod_ssl
Red Hat:jboss_enterprise_application_platform:6::el5
From an advisory covering 2 CVEs
 before 1:2.2.22-27.ep6.el5
1:2.2.22-27.ep6.el5
httpd
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 2 CVEs
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
httpd-debuginfo
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 2 CVEs
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
httpd-devel
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 2 CVEs
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
httpd-tools
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 2 CVEs
 before 0:2.2.22-27.ep6.el6
0:2.2.22-27.ep6.el6
mod_ssl
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 2 CVEs
 before 1:2.2.22-27.ep6.el6
1:2.2.22-27.ep6.el6
apache2
openSUSE:Tumbleweed
From an advisory covering 48 CVEs
 before 2.4.23-4.1
2.4.23-4.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0098 is a medium vulnerability (CVSS 5.0) in Apache Http Server, published March 18, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 26.7%, the 98th percentile. Fixed in apache2 2.4.9-1.

References

Show 161 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open