CVE-2007-3847
The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a...
5.0 MediumFix available
The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.
Exploit likelihood
12.9%Up 2.0 points since Feb 4, 2022
What each source reports
NVD Score used
The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.
- Record
CVE-2007-3847- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE ListNo score
The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.
- Record
CVE-2007-3847- Updated
- 2026-11-02
EUVDEUVD-2007-3831No score
The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.
- Record
EUVD-2007-3831- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v7h4-gr67-jxvjNo score
The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a...
The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.
- Record
GHSA-v7h4-gr67-jxvj- Weakness
- CWE-125
- Updated
- 2026-11-02
OSVNo score
The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.
- Record
CVE-2007-3847- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-3847No score
The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.
- Record
DEBIAN-CVE-2007-3847- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10623-1No score
apache2-2.4.49-1.1 on GA media
These are all security issues fixed in the apache2-2.4.49-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10623-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache2Debian:12 | before 2.2.6-1 | 2.2.6-1 |
apache2Debian:13 | before 2.2.6-1 | 2.2.6-1 |
apache2Debian:14 | before 2.2.6-1 | 2.2.6-1 |
httpdRed Hat:enterprise_linux:5::client_workstation | before 0:2.2.3-11.el5 | 0:2.2.3-11.el5 |
httpd-debuginfoRed Hat:enterprise_linux:5::client_workstation | before 0:2.2.3-11.el5 | 0:2.2.3-11.el5 |
httpd-develRed Hat:enterprise_linux:5::client_workstation | before 0:2.2.3-11.el5 | 0:2.2.3-11.el5 |
httpd-manualRed Hat:enterprise_linux:5::client_workstation | before 0:2.2.3-11.el5 | 0:2.2.3-11.el5 |
httpdRed Hat:enterprise_linux:5::client | before 0:2.2.3-11.el5 | 0:2.2.3-11.el5 |
httpd-debuginfoRed Hat:enterprise_linux:5::client | before 0:2.2.3-11.el5 | 0:2.2.3-11.el5 |
mod_sslRed Hat:enterprise_linux:5::client | before 1:2.2.3-11.el5 | 1:2.2.3-11.el5 |
Show 90 moreShow less
| Package | Affected | Fixed |
|---|---|---|
httpdRed Hat:enterprise_linux:5::server | before 0:2.2.3-11.el5 | 0:2.2.3-11.el5 |
httpd-debuginfoRed Hat:enterprise_linux:5::server | before 0:2.2.3-11.el5 | 0:2.2.3-11.el5 |
httpd-develRed Hat:enterprise_linux:5::server | before 0:2.2.3-11.el5 | 0:2.2.3-11.el5 |
httpd-manualRed Hat:enterprise_linux:5::server | before 0:2.2.3-11.el5 | 0:2.2.3-11.el5 |
mod_sslRed Hat:enterprise_linux:5::server | before 1:2.2.3-11.el5 | 1:2.2.3-11.el5 |
httpdRed Hat:enterprise_linux:4::as | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
httpd-debuginfoRed Hat:enterprise_linux:4::as | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
httpd-develRed Hat:enterprise_linux:4::as | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
httpd-manualRed Hat:enterprise_linux:4::as | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
httpd-suexecRed Hat:enterprise_linux:4::as | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
mod_sslRed Hat:enterprise_linux:4::as | before 1:2.0.52-38.ent | 1:2.0.52-38.ent |
httpdRed Hat:enterprise_linux:4::desktop | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
httpd-debuginfoRed Hat:enterprise_linux:4::desktop | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
httpd-develRed Hat:enterprise_linux:4::desktop | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
httpd-manualRed Hat:enterprise_linux:4::desktop | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
httpd-suexecRed Hat:enterprise_linux:4::desktop | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
mod_sslRed Hat:enterprise_linux:4::desktop | before 1:2.0.52-38.ent | 1:2.0.52-38.ent |
httpdRed Hat:enterprise_linux:4::es | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
httpd-debuginfoRed Hat:enterprise_linux:4::es | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
httpd-develRed Hat:enterprise_linux:4::es | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
httpd-manualRed Hat:enterprise_linux:4::es | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
httpd-suexecRed Hat:enterprise_linux:4::es | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
mod_sslRed Hat:enterprise_linux:4::es | before 1:2.0.52-38.ent | 1:2.0.52-38.ent |
httpdRed Hat:enterprise_linux:4::ws | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
httpd-debuginfoRed Hat:enterprise_linux:4::ws | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
httpd-develRed Hat:enterprise_linux:4::ws | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
httpd-manualRed Hat:enterprise_linux:4::ws | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
httpd-suexecRed Hat:enterprise_linux:4::ws | before 0:2.0.52-38.ent | 0:2.0.52-38.ent |
mod_sslRed Hat:enterprise_linux:4::ws | before 1:2.0.52-38.ent | 1:2.0.52-38.ent |
httpdRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs | before 0:2.0.59-1.el4s1.8 | 0:2.0.59-1.el4s1.8 |
httpd-debuginfoRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs | before 0:2.0.59-1.el4s1.8 | 0:2.0.59-1.el4s1.8 |
httpd-develRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs | before 0:2.0.59-1.el4s1.8 | 0:2.0.59-1.el4s1.8 |
httpd-manualRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs | before 0:2.0.59-1.el4s1.8 | 0:2.0.59-1.el4s1.8 |
mod_sslRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs | before 1:2.0.59-1.el4s1.8 | 1:2.0.59-1.el4s1.8 |
httpdRed Hat:enterprise_linux:3::as From an advisory covering 5 CVEs | before 0:2.0.46-70.ent | 0:2.0.46-70.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 5 CVEs | before 0:2.0.46-70.ent | 0:2.0.46-70.ent |
httpd-develRed Hat:enterprise_linux:3::as From an advisory covering 5 CVEs | before 0:2.0.46-70.ent | 0:2.0.46-70.ent |
mod_sslRed Hat:enterprise_linux:3::as From an advisory covering 5 CVEs | before 1:2.0.46-70.ent | 1:2.0.46-70.ent |
httpdRed Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs | before 0:2.0.46-70.ent | 0:2.0.46-70.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs | before 0:2.0.46-70.ent | 0:2.0.46-70.ent |
httpd-develRed Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs | before 0:2.0.46-70.ent | 0:2.0.46-70.ent |
mod_sslRed Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs | before 1:2.0.46-70.ent | 1:2.0.46-70.ent |
httpdRed Hat:enterprise_linux:3::es From an advisory covering 5 CVEs | before 0:2.0.46-70.ent | 0:2.0.46-70.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 5 CVEs | before 0:2.0.46-70.ent | 0:2.0.46-70.ent |
httpd-develRed Hat:enterprise_linux:3::es From an advisory covering 5 CVEs | before 0:2.0.46-70.ent | 0:2.0.46-70.ent |
mod_sslRed Hat:enterprise_linux:3::es From an advisory covering 5 CVEs | before 1:2.0.46-70.ent | 1:2.0.46-70.ent |
httpdRed Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs | before 0:2.0.46-70.ent | 0:2.0.46-70.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs | before 0:2.0.46-70.ent | 0:2.0.46-70.ent |
httpd-develRed Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs | before 0:2.0.46-70.ent | 0:2.0.46-70.ent |
mod_sslRed Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs | before 1:2.0.46-70.ent | 1:2.0.46-70.ent |
antRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.6.5-1jpp_1rh | 0:1.6.5-1jpp_1rh |
avalon-logkitRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.2-2jpp_4rh | 0:1.2-2jpp_4rh |
axisRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.2.1-1jpp_3rh | 0:1.2.1-1jpp_3rh |
classpathx-jafRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-2jpp_6rh | 0:1.0-2jpp_6rh |
classpathx-mailRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.1.1-2jpp_8rh | 0:1.1.1-2jpp_8rh |
geronimo-ejb-2.1-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-1.4-apisRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-connector-1.5-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-deployment-1.1-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-management-1.0-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jms-1.1-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jsp-2.0-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jta-1.0.1B-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-servlet-2.4-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-specsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-specs-javadocRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
jakarta-commons-modelerRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:2.0-3jpp_2rh | 0:2.0-3jpp_2rh |
log4jRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.2.12-1jpp_1rh | 0:1.2.12-1jpp_1rh |
mx4jRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 1:3.0.1-1jpp_4rh | 1:3.0.1-1jpp_4rh |
pcsc-liteRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-debuginfoRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-docRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-libsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
rhpki-caRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-20.el4 | 0:7.3.0-20.el4 |
rhpki-java-toolsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-10.el4 | 0:7.3.0-10.el4 |
rhpki-kraRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-14.el4 | 0:7.3.0-14.el4 |
rhpki-manageRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-19.el4 | 0:7.3.0-19.el4 |
rhpki-native-toolsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-6.el4 | 0:7.3.0-6.el4 |
rhpki-ocspRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-13.el4 | 0:7.3.0-13.el4 |
rhpki-tksRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-13.el4 | 0:7.3.0-13.el4 |
tomcat5Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-common-libRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-jasperRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-jsp-2.0-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-server-libRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-servlet-2.4-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
xerces-j2Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:2.7.1-1jpp_1rh | 0:2.7.1-1jpp_1rh |
xml-commonsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.02-2jpp_1rh | 0:1.3.02-2jpp_1rh |
xml-commons-apisRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.02-2jpp_1rh | 0:1.3.02-2jpp_1rh |
apache2openSUSE:Tumbleweed From an advisory covering 27 CVEs | before 2.4.49-1.1 | 2.4.49-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3847 is a medium vulnerability (CVSS 5.0) in Apache Http Server, published August 23, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.9%, the 96th percentile. Fixed in apache2 2.2.6-1.
References
secunia.com/advisories/28606
redhat.com/support/errata/RHSA-2008-0005.html
vupen.com/english/advisories/2007/3955
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10525
Show 194 moreShow less
www-1.ibm.com/support/docview.wss?uid=swg1PK52702
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588
slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748
securitytracker.com/id?1018633
marc.info?l=apache-httpd-dev&m=118595953217856&w=2
oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
httpd.apache.org/security/vulnerabilities_20.html
us-cert.gov/cas/techalerts/TA08-150A.html
novell.com/linux/security/advisories/2007_61_apache2.html
issues.rpath.com/browse/RPL-1710
lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
mandriva.com/security/advisories?name=MDKSA-2007:235
support.avaya.com/elmodocs2/security/ASA-2007-500.htm
securityfocus.com/archive/1/505990/100/0/threaded
fujitsu.com/global/support/software/security/products-f/interstage-200802e.html
lists.vmware.com/pipermail/security-announce/2009/000062.html
security.gentoo.org/glsa/glsa-200711-06.xml
docs.info.apple.com/article.html?artnum=307562
ubuntu.com/usn/usn-575-1
bugs.gentoo.org/show_bug.cgi?id=186219
lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2007-3847
access.redhat.com/errata/RHSA-2007:0746
bugzilla.redhat.com/show_bug.cgi?id=250731
github.com/advisories/GHSA-v7h4-gr67-jxvj
security-tracker.debian.org/tracker/CVE-2007-3847
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0746.json
cve.org/CVERecord?id=CVE-2007-3847
suse.com/security/cve/CVE-2005-3352
This page doesn't list everything
Left out here: 113 references. The JSON record has them.