CVE-2016-4975

mod_userdir CRLF injection

6.1 MediumFix available

CVE-2016-4975 is a medium vulnerability (CVSS 6.1) in Apache Http Server, published August 14, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 19.8%, the 97th percentile. Fixed in apache2 2.4.25-1.

Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

19.8%Up 14.6 points since Feb 4, 2022

What each source reports

NVD Score used 6.1

Record: CVE-2016-4975
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-93
Updated: 2026-11-02

CVE List No score

mod_userdir CRLF injection

Record: CVE-2016-4975
Updated: 2026-11-02

EUVDEUVD-2016-5946 No score

Record: EUVD-2016-5946
Updated: 2026-11-03

GitHub AdvisoriesGHSA-crcg-r773-w4rv 6.1

Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir....

Record: GHSA-crcg-r773-w4rv
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-93
Updated: 2026-11-02

OSVBELL-CVE-2016-4975 6.1

CVE-2016-4975 does not affect BellSoft software

Record: BELL-CVE-2016-4975
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSV 6.1

Record: CVE-2016-4975
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Show 8 moreShow less

OSVDEBIAN-CVE-2016-4975 6.1

Record: DEBIAN-CVE-2016-4975
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVRHSA-2017:0906 7.5

Red Hat Security Advisory: httpd security and bug fix update

Record: RHSA-2017:0906
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2018:2185 6.2

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 7 security update

Record: RHSA-2018:2185
CVSS 3.0: 6.2 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2018:2186 6.2

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 6 security update

Record: RHSA-2018:2186
CVSS 3.0: 6.2 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-4975 6.1

Record: UBUNTU-CVE-2016-4975
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVSUSE-SU-2018:2554-1 No score

Security update for apache2

This update for apache2 fixes the following issues:

Security issues fixed:

CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution. (bsc#1016715)
CVE-2016-4975: Fixed possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes which prohibit CR or LF injection into the 'Location' or other outbound header key or value. (bsc#1104826)

Record: SUSE-SU-2018:2554-1
Updated: 2026-11-02

OSVSUSE-SU-2018:2815-1 No score

Security update for apache2

This update for apache2 fixes the following issues:

Security issues fixed:

CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution. (bsc#1016715)
CVE-2016-4975: Fixed possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes which prohibit CR or LF injection into the 'Location' or other outbound header key or value. (bsc#1104826)

Record: SUSE-SU-2018:2815-1
Updated: 2026-11-02

OSVSUSE-SU-2018:2815-2 No score

Security update for apache2

This update for apache2 fixes the following issues:

Security issues fixed:

CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution. (bsc#1016715)
CVE-2016-4975: Fixed possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes which prohibit CR or LF injection into the 'Location' or other outbound header key or value. (bsc#1104826)

Record: SUSE-SU-2018:2815-2
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`apache2` Debian:12	before 2.4.25-1	2.4.25-1
`apache2` Debian:13	before 2.4.25-1	2.4.25-1
`apache2` Debian:14	before 2.4.25-1	2.4.25-1
`httpd` Red Hat:enterprise_linux:7::client	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`httpd-debuginfo` Red Hat:enterprise_linux:7::client	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`httpd-devel` Red Hat:enterprise_linux:7::client	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`httpd-manual` Red Hat:enterprise_linux:7::client	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`httpd-tools` Red Hat:enterprise_linux:7::client	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`mod_ldap` Red Hat:enterprise_linux:7::client	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`mod_proxy_html` Red Hat:enterprise_linux:7::client	before 1:2.4.6-45.el7_3.4	1:2.4.6-45.el7_3.4

Show 139 moreShow less

Affected packages
Package	Affected	Fixed
`mod_session` Red Hat:enterprise_linux:7::client	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`mod_ssl` Red Hat:enterprise_linux:7::client	before 1:2.4.6-45.el7_3.4	1:2.4.6-45.el7_3.4
`httpd` Red Hat:enterprise_linux:7::computenode	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`httpd-debuginfo` Red Hat:enterprise_linux:7::computenode	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`httpd-devel` Red Hat:enterprise_linux:7::computenode	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`httpd-manual` Red Hat:enterprise_linux:7::computenode	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`httpd-tools` Red Hat:enterprise_linux:7::computenode	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`mod_ldap` Red Hat:enterprise_linux:7::computenode	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`mod_proxy_html` Red Hat:enterprise_linux:7::computenode	before 1:2.4.6-45.el7_3.4	1:2.4.6-45.el7_3.4
`mod_session` Red Hat:enterprise_linux:7::computenode	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`mod_ssl` Red Hat:enterprise_linux:7::computenode	before 1:2.4.6-45.el7_3.4	1:2.4.6-45.el7_3.4
`httpd` Red Hat:enterprise_linux:7::server	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`httpd-debuginfo` Red Hat:enterprise_linux:7::server	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`httpd-devel` Red Hat:enterprise_linux:7::server	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`httpd-manual` Red Hat:enterprise_linux:7::server	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`httpd-tools` Red Hat:enterprise_linux:7::server	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`mod_ssl` Red Hat:enterprise_linux:7::server	before 1:2.4.6-45.el7_3.4	1:2.4.6-45.el7_3.4
`mod_ldap` Red Hat:enterprise_linux:7::server	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`mod_proxy_html` Red Hat:enterprise_linux:7::server	before 1:2.4.6-45.el7_3.4	1:2.4.6-45.el7_3.4
`mod_session` Red Hat:enterprise_linux:7::server	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`httpd` Red Hat:enterprise_linux:7::workstation	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`httpd-debuginfo` Red Hat:enterprise_linux:7::workstation	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`httpd-devel` Red Hat:enterprise_linux:7::workstation	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`httpd-manual` Red Hat:enterprise_linux:7::workstation	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`httpd-tools` Red Hat:enterprise_linux:7::workstation	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`mod_ssl` Red Hat:enterprise_linux:7::workstation	before 1:2.4.6-45.el7_3.4	1:2.4.6-45.el7_3.4
`mod_ldap` Red Hat:enterprise_linux:7::workstation	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`mod_proxy_html` Red Hat:enterprise_linux:7::workstation	before 1:2.4.6-45.el7_3.4	1:2.4.6-45.el7_3.4
`mod_session` Red Hat:enterprise_linux:7::workstation	before 0:2.4.6-45.el7_3.4	0:2.4.6-45.el7_3.4
`jbcs-httpd24-apache-commons-daemon` Red Hat:jboss_core_services:1::el7	before 0:1.1.0-1.redhat_2.1.jbcs.el7	0:1.1.0-1.redhat_2.1.jbcs.el7
`jbcs-httpd24-apache-commons-daemon-jsvc` Red Hat:jboss_core_services:1::el7	before 1:1.1.0-1.redhat_2.jbcs.el7	1:1.1.0-1.redhat_2.jbcs.el7
`jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo` Red Hat:jboss_core_services:1::el7	before 1:1.1.0-1.redhat_2.jbcs.el7	1:1.1.0-1.redhat_2.jbcs.el7
`jbcs-httpd24-apr` Red Hat:jboss_core_services:1::el7	before 0:1.6.3-14.jbcs.el7	0:1.6.3-14.jbcs.el7
`jbcs-httpd24-apr-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:1.6.3-14.jbcs.el7	0:1.6.3-14.jbcs.el7
`jbcs-httpd24-apr-devel` Red Hat:jboss_core_services:1::el7	before 0:1.6.3-14.jbcs.el7	0:1.6.3-14.jbcs.el7
`jbcs-httpd24-apr-util` Red Hat:jboss_core_services:1::el7	before 0:1.6.1-9.jbcs.el7	0:1.6.1-9.jbcs.el7
`jbcs-httpd24-apr-util-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:1.6.1-9.jbcs.el7	0:1.6.1-9.jbcs.el7
`jbcs-httpd24-apr-util-devel` Red Hat:jboss_core_services:1::el7	before 0:1.6.1-9.jbcs.el7	0:1.6.1-9.jbcs.el7
`jbcs-httpd24-apr-util-ldap` Red Hat:jboss_core_services:1::el7	before 0:1.6.1-9.jbcs.el7	0:1.6.1-9.jbcs.el7
`jbcs-httpd24-apr-util-mysql` Red Hat:jboss_core_services:1::el7	before 0:1.6.1-9.jbcs.el7	0:1.6.1-9.jbcs.el7
`jbcs-httpd24-apr-util-nss` Red Hat:jboss_core_services:1::el7	before 0:1.6.1-9.jbcs.el7	0:1.6.1-9.jbcs.el7
`jbcs-httpd24-apr-util-odbc` Red Hat:jboss_core_services:1::el7	before 0:1.6.1-9.jbcs.el7	0:1.6.1-9.jbcs.el7
`jbcs-httpd24-apr-util-openssl` Red Hat:jboss_core_services:1::el7	before 0:1.6.1-9.jbcs.el7	0:1.6.1-9.jbcs.el7
`jbcs-httpd24-apr-util-pgsql` Red Hat:jboss_core_services:1::el7	before 0:1.6.1-9.jbcs.el7	0:1.6.1-9.jbcs.el7
`jbcs-httpd24-apr-util-sqlite` Red Hat:jboss_core_services:1::el7	before 0:1.6.1-9.jbcs.el7	0:1.6.1-9.jbcs.el7
`jbcs-httpd24-httpd` Red Hat:jboss_core_services:1::el7	before 0:2.4.29-17.jbcs.el7	0:2.4.29-17.jbcs.el7
`jbcs-httpd24-httpd-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:2.4.29-17.jbcs.el7	0:2.4.29-17.jbcs.el7
`jbcs-httpd24-httpd-devel` Red Hat:jboss_core_services:1::el7	before 0:2.4.29-17.jbcs.el7	0:2.4.29-17.jbcs.el7
`jbcs-httpd24-httpd-manual` Red Hat:jboss_core_services:1::el7	before 0:2.4.29-17.jbcs.el7	0:2.4.29-17.jbcs.el7
`jbcs-httpd24-httpd-selinux` Red Hat:jboss_core_services:1::el7	before 0:2.4.29-17.jbcs.el7	0:2.4.29-17.jbcs.el7
`jbcs-httpd24-httpd-tools` Red Hat:jboss_core_services:1::el7	before 0:2.4.29-17.jbcs.el7	0:2.4.29-17.jbcs.el7
`jbcs-httpd24-mod_auth_kerb` Red Hat:jboss_core_services:1::el7	before 0:5.4-36.jbcs.el7	0:5.4-36.jbcs.el7
`jbcs-httpd24-mod_auth_kerb-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:5.4-36.jbcs.el7	0:5.4-36.jbcs.el7
`jbcs-httpd24-mod_bmx` Red Hat:jboss_core_services:1::el7	before 0:0.9.6-17.GA.jbcs.el7	0:0.9.6-17.GA.jbcs.el7
`jbcs-httpd24-mod_bmx-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:0.9.6-17.GA.jbcs.el7	0:0.9.6-17.GA.jbcs.el7
`jbcs-httpd24-mod_cluster-native` Red Hat:jboss_core_services:1::el7	before 0:1.3.8-1.Final_redhat_2.jbcs.el7	0:1.3.8-1.Final_redhat_2.jbcs.el7
`jbcs-httpd24-mod_cluster-native-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:1.3.8-1.Final_redhat_2.jbcs.el7	0:1.3.8-1.Final_redhat_2.jbcs.el7
`jbcs-httpd24-mod_jk` Red Hat:jboss_core_services:1::el7	before 0:1.2.43-1.redhat_1.jbcs.el7	0:1.2.43-1.redhat_1.jbcs.el7
`jbcs-httpd24-mod_jk-ap24` Red Hat:jboss_core_services:1::el7	before 0:1.2.43-1.redhat_1.jbcs.el7	0:1.2.43-1.redhat_1.jbcs.el7
`jbcs-httpd24-mod_jk-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:1.2.43-1.redhat_1.jbcs.el7	0:1.2.43-1.redhat_1.jbcs.el7
`jbcs-httpd24-mod_jk-manual` Red Hat:jboss_core_services:1::el7	before 0:1.2.43-1.redhat_1.jbcs.el7	0:1.2.43-1.redhat_1.jbcs.el7
`jbcs-httpd24-mod_ldap` Red Hat:jboss_core_services:1::el7	before 0:2.4.29-17.jbcs.el7	0:2.4.29-17.jbcs.el7
`jbcs-httpd24-mod_proxy_html` Red Hat:jboss_core_services:1::el7	before 1:2.4.29-17.jbcs.el7	1:2.4.29-17.jbcs.el7
`jbcs-httpd24-mod_rt` Red Hat:jboss_core_services:1::el7	before 0:2.4.1-19.GA.jbcs.el7	0:2.4.1-19.GA.jbcs.el7
`jbcs-httpd24-mod_rt-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:2.4.1-19.GA.jbcs.el7	0:2.4.1-19.GA.jbcs.el7
`jbcs-httpd24-mod_security` Red Hat:jboss_core_services:1::el7	before 0:2.9.1-23.GA.jbcs.el7	0:2.9.1-23.GA.jbcs.el7
`jbcs-httpd24-mod_security-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:2.9.1-23.GA.jbcs.el7	0:2.9.1-23.GA.jbcs.el7
`jbcs-httpd24-mod_session` Red Hat:jboss_core_services:1::el7	before 0:2.4.29-17.jbcs.el7	0:2.4.29-17.jbcs.el7
`jbcs-httpd24-mod_ssl` Red Hat:jboss_core_services:1::el7	before 1:2.4.29-17.jbcs.el7	1:2.4.29-17.jbcs.el7
`jbcs-httpd24-nghttp2` Red Hat:jboss_core_services:1::el7	before 0:1.29.0-8.jbcs.el7	0:1.29.0-8.jbcs.el7
`jbcs-httpd24-nghttp2-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:1.29.0-8.jbcs.el7	0:1.29.0-8.jbcs.el7
`jbcs-httpd24-nghttp2-devel` Red Hat:jboss_core_services:1::el7	before 0:1.29.0-8.jbcs.el7	0:1.29.0-8.jbcs.el7
`jbcs-httpd24-openssl` Red Hat:jboss_core_services:1::el7	before 1:1.0.2n-11.jbcs.el7	1:1.0.2n-11.jbcs.el7
`jbcs-httpd24-openssl-debuginfo` Red Hat:jboss_core_services:1::el7	before 1:1.0.2n-11.jbcs.el7	1:1.0.2n-11.jbcs.el7
`jbcs-httpd24-openssl-devel` Red Hat:jboss_core_services:1::el7	before 1:1.0.2n-11.jbcs.el7	1:1.0.2n-11.jbcs.el7
`jbcs-httpd24-openssl-libs` Red Hat:jboss_core_services:1::el7	before 1:1.0.2n-11.jbcs.el7	1:1.0.2n-11.jbcs.el7
`jbcs-httpd24-openssl-perl` Red Hat:jboss_core_services:1::el7	before 1:1.0.2n-11.jbcs.el7	1:1.0.2n-11.jbcs.el7
`jbcs-httpd24-openssl-static` Red Hat:jboss_core_services:1::el7	before 1:1.0.2n-11.jbcs.el7	1:1.0.2n-11.jbcs.el7
`jbcs-httpd24-apache-commons-daemon` Red Hat:jboss_core_services:1::el6	before 0:1.1.0-1.redhat_2.1.jbcs.el6	0:1.1.0-1.redhat_2.1.jbcs.el6
`jbcs-httpd24-apache-commons-daemon-jsvc` Red Hat:jboss_core_services:1::el6	before 1:1.1.0-1.redhat_2.jbcs.el6	1:1.1.0-1.redhat_2.jbcs.el6
`jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo` Red Hat:jboss_core_services:1::el6	before 1:1.1.0-1.redhat_2.jbcs.el6	1:1.1.0-1.redhat_2.jbcs.el6
`jbcs-httpd24-apr` Red Hat:jboss_core_services:1::el6	before 0:1.6.3-14.jbcs.el6	0:1.6.3-14.jbcs.el6
`jbcs-httpd24-apr-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:1.6.3-14.jbcs.el6	0:1.6.3-14.jbcs.el6
`jbcs-httpd24-apr-devel` Red Hat:jboss_core_services:1::el6	before 0:1.6.3-14.jbcs.el6	0:1.6.3-14.jbcs.el6
`jbcs-httpd24-apr-util` Red Hat:jboss_core_services:1::el6	before 0:1.6.1-9.jbcs.el6	0:1.6.1-9.jbcs.el6
`jbcs-httpd24-apr-util-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:1.6.1-9.jbcs.el6	0:1.6.1-9.jbcs.el6
`jbcs-httpd24-apr-util-devel` Red Hat:jboss_core_services:1::el6	before 0:1.6.1-9.jbcs.el6	0:1.6.1-9.jbcs.el6
`jbcs-httpd24-apr-util-ldap` Red Hat:jboss_core_services:1::el6	before 0:1.6.1-9.jbcs.el6	0:1.6.1-9.jbcs.el6
`jbcs-httpd24-apr-util-mysql` Red Hat:jboss_core_services:1::el6	before 0:1.6.1-9.jbcs.el6	0:1.6.1-9.jbcs.el6
`jbcs-httpd24-apr-util-nss` Red Hat:jboss_core_services:1::el6	before 0:1.6.1-9.jbcs.el6	0:1.6.1-9.jbcs.el6
`jbcs-httpd24-apr-util-odbc` Red Hat:jboss_core_services:1::el6	before 0:1.6.1-9.jbcs.el6	0:1.6.1-9.jbcs.el6
`jbcs-httpd24-apr-util-openssl` Red Hat:jboss_core_services:1::el6	before 0:1.6.1-9.jbcs.el6	0:1.6.1-9.jbcs.el6
`jbcs-httpd24-apr-util-pgsql` Red Hat:jboss_core_services:1::el6	before 0:1.6.1-9.jbcs.el6	0:1.6.1-9.jbcs.el6
`jbcs-httpd24-apr-util-sqlite` Red Hat:jboss_core_services:1::el6	before 0:1.6.1-9.jbcs.el6	0:1.6.1-9.jbcs.el6
`jbcs-httpd24-httpd` Red Hat:jboss_core_services:1::el6	before 0:2.4.29-17.jbcs.el6	0:2.4.29-17.jbcs.el6
`jbcs-httpd24-httpd-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:2.4.29-17.jbcs.el6	0:2.4.29-17.jbcs.el6
`jbcs-httpd24-httpd-devel` Red Hat:jboss_core_services:1::el6	before 0:2.4.29-17.jbcs.el6	0:2.4.29-17.jbcs.el6
`jbcs-httpd24-httpd-manual` Red Hat:jboss_core_services:1::el6	before 0:2.4.29-17.jbcs.el6	0:2.4.29-17.jbcs.el6
`jbcs-httpd24-httpd-selinux` Red Hat:jboss_core_services:1::el6	before 0:2.4.29-17.jbcs.el6	0:2.4.29-17.jbcs.el6
`jbcs-httpd24-httpd-tools` Red Hat:jboss_core_services:1::el6	before 0:2.4.29-17.jbcs.el6	0:2.4.29-17.jbcs.el6
`jbcs-httpd24-mod_auth_kerb` Red Hat:jboss_core_services:1::el6	before 0:5.4-36.jbcs.el6	0:5.4-36.jbcs.el6
`jbcs-httpd24-mod_auth_kerb-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:5.4-36.jbcs.el6	0:5.4-36.jbcs.el6
`jbcs-httpd24-mod_bmx` Red Hat:jboss_core_services:1::el6	before 0:0.9.6-17.GA.jbcs.el6	0:0.9.6-17.GA.jbcs.el6
`jbcs-httpd24-mod_bmx-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:0.9.6-17.GA.jbcs.el6	0:0.9.6-17.GA.jbcs.el6
`jbcs-httpd24-mod_cluster-native` Red Hat:jboss_core_services:1::el6	before 0:1.3.8-1.Final_redhat_2.jbcs.el6	0:1.3.8-1.Final_redhat_2.jbcs.el6
`jbcs-httpd24-mod_cluster-native-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:1.3.8-1.Final_redhat_2.jbcs.el6	0:1.3.8-1.Final_redhat_2.jbcs.el6
`jbcs-httpd24-mod_jk` Red Hat:jboss_core_services:1::el6	before 0:1.2.43-1.redhat_1.jbcs.el6	0:1.2.43-1.redhat_1.jbcs.el6
`jbcs-httpd24-mod_jk-ap24` Red Hat:jboss_core_services:1::el6	before 0:1.2.43-1.redhat_1.jbcs.el6	0:1.2.43-1.redhat_1.jbcs.el6
`jbcs-httpd24-mod_jk-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:1.2.43-1.redhat_1.jbcs.el6	0:1.2.43-1.redhat_1.jbcs.el6
`jbcs-httpd24-mod_jk-manual` Red Hat:jboss_core_services:1::el6	before 0:1.2.43-1.redhat_1.jbcs.el6	0:1.2.43-1.redhat_1.jbcs.el6
`jbcs-httpd24-mod_ldap` Red Hat:jboss_core_services:1::el6	before 0:2.4.29-17.jbcs.el6	0:2.4.29-17.jbcs.el6
`jbcs-httpd24-mod_proxy_html` Red Hat:jboss_core_services:1::el6	before 1:2.4.29-17.jbcs.el6	1:2.4.29-17.jbcs.el6
`jbcs-httpd24-mod_rt` Red Hat:jboss_core_services:1::el6	before 0:2.4.1-19.GA.jbcs.el6	0:2.4.1-19.GA.jbcs.el6
`jbcs-httpd24-mod_rt-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:2.4.1-19.GA.jbcs.el6	0:2.4.1-19.GA.jbcs.el6
`jbcs-httpd24-mod_security` Red Hat:jboss_core_services:1::el6	before 0:2.9.1-23.GA.jbcs.el6	0:2.9.1-23.GA.jbcs.el6
`jbcs-httpd24-mod_security-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:2.9.1-23.GA.jbcs.el6	0:2.9.1-23.GA.jbcs.el6
`jbcs-httpd24-mod_session` Red Hat:jboss_core_services:1::el6	before 0:2.4.29-17.jbcs.el6	0:2.4.29-17.jbcs.el6
`jbcs-httpd24-mod_ssl` Red Hat:jboss_core_services:1::el6	before 1:2.4.29-17.jbcs.el6	1:2.4.29-17.jbcs.el6
`jbcs-httpd24-nghttp2` Red Hat:jboss_core_services:1::el6	before 0:1.29.0-8.jbcs.el6	0:1.29.0-8.jbcs.el6
`jbcs-httpd24-nghttp2-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:1.29.0-8.jbcs.el6	0:1.29.0-8.jbcs.el6
`jbcs-httpd24-nghttp2-devel` Red Hat:jboss_core_services:1::el6	before 0:1.29.0-8.jbcs.el6	0:1.29.0-8.jbcs.el6
`jbcs-httpd24-openssl` Red Hat:jboss_core_services:1::el6	before 1:1.0.2n-11.jbcs.el6	1:1.0.2n-11.jbcs.el6
`jbcs-httpd24-openssl-debuginfo` Red Hat:jboss_core_services:1::el6	before 1:1.0.2n-11.jbcs.el6	1:1.0.2n-11.jbcs.el6
`jbcs-httpd24-openssl-devel` Red Hat:jboss_core_services:1::el6	before 1:1.0.2n-11.jbcs.el6	1:1.0.2n-11.jbcs.el6
`jbcs-httpd24-openssl-libs` Red Hat:jboss_core_services:1::el6	before 1:1.0.2n-11.jbcs.el6	1:1.0.2n-11.jbcs.el6
`jbcs-httpd24-openssl-perl` Red Hat:jboss_core_services:1::el6	before 1:1.0.2n-11.jbcs.el6	1:1.0.2n-11.jbcs.el6
`jbcs-httpd24-openssl-static` Red Hat:jboss_core_services:1::el6	before 1:1.0.2n-11.jbcs.el6	1:1.0.2n-11.jbcs.el6
`apache2` SUSE:Linux Enterprise Server for SAP Applications 12 SP1	before 2.4.16-20.19.1	2.4.16-20.19.1
`apache2` SUSE:Linux Enterprise Server 12 SP1-LTSS	before 2.4.16-20.19.1	2.4.16-20.19.1
`apache2` SUSE:OpenStack Cloud 7	before 2.4.23-29.24.1	2.4.23-29.24.1
`apache2` SUSE:Linux Enterprise Server for SAP Applications 12 SP2	before 2.4.23-29.24.1	2.4.23-29.24.1
`apache2` SUSE:Linux Enterprise Software Development Kit 12 SP3	before 2.4.23-29.24.1	2.4.23-29.24.1
`apache2` SUSE:Linux Enterprise Server 12 SP2-LTSS	before 2.4.23-29.24.1	2.4.23-29.24.1
`apache2` SUSE:Linux Enterprise Server 12 SP3	before 2.4.23-29.24.1	2.4.23-29.24.1
`apache2` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	before 2.4.23-29.24.1	2.4.23-29.24.1
`apache2` SUSE:Enterprise Storage 4	before 2.4.23-29.24.1	2.4.23-29.24.1
`apache2` SUSE:Linux Enterprise Server 12 SP2-BCL	before 2.4.23-29.24.1	2.4.23-29.24.1
`apache2` Ubuntu:14.04:LTS	before 2.4.7-1ubuntu4.15, plus listed versions 2.4.6-2ubuntu22.4.6-2ubuntu32.4.6-2ubuntu42.4.7-1ubuntu12.4.7-1ubuntu2 Show 12 moreShow less 2.4.7-1ubuntu32.4.7-1ubuntu42.4.7-1ubuntu4.12.4.7-1ubuntu4.42.4.7-1ubuntu4.52.4.7-1ubuntu4.62.4.7-1ubuntu4.72.4.7-1ubuntu4.82.4.7-1ubuntu4.92.4.7-1ubuntu4.102.4.7-1ubuntu4.112.4.7-1ubuntu4.13	2.4.7-1ubuntu4.15
`apache2` Ubuntu:16.04:LTS	before 2.4.18-2ubuntu3.2, plus listed versions 2.4.12-2ubuntu22.4.17-1ubuntu12.4.17-2ubuntu12.4.17-3ubuntu12.4.18-1ubuntu1 Show 4 moreShow less 2.4.18-2ubuntu12.4.18-2ubuntu22.4.18-2ubuntu32.4.18-2ubuntu3.1	2.4.18-2ubuntu3.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	Apache mod_userdir CRLF injection

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, Nuclei, NVD, OSV

References

Show 120 moreShow less