Every CVE Search/ Get API key

CVE-2006-3747

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3...

7.6 HighPublic exploitFix available

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.

Exploit likelihood

97.1%Up 17.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.6

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.

Record
CVE-2006-3747
CVSS 2.0
7.6 HighAV:N/AC:H/Au:N/C:C/I:C/A:C
Weakness
CWE-189
Updated
2026-11-02
CVE List No score

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.

Record
CVE-2006-3747
Updated
2026-11-02
EUVDEUVD-2006-3741 No score

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.

Record
EUVD-2006-3741
Updated
2026-11-03
GitHub AdvisoriesGHSA-47q7-qpgp-938j No score

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3...

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.

Record
GHSA-47q7-qpgp-938j
Updated
2026-11-02
OSV No score

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.

Record
CVE-2006-3747
Updated
2026-11-02
OSVDEBIAN-CVE-2006-3747 No score

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.

Record
DEBIAN-CVE-2006-3747
Updated
2026-11-02
OSVopenSUSE-SU-2024:10623-1 No score

apache2-2.4.49-1.1 on GA media

These are all security issues fixed in the apache2-2.4.49-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10623-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Debian:12
 before 2.0.55-4.1
2.0.55-4.1
apache2
Debian:13
 before 2.0.55-4.1
2.0.55-4.1
apache2
Debian:14
 before 2.0.55-4.1
2.0.55-4.1
apache
Debian:3.1
 before 1.3.33-6sarge2, plus listed versions
1.3.33-61.3.33-6sarge1
1.3.33-6sarge2
apache2
Debian:3.1
 before 2.0.54-5sarge1, plus listed versions
2.0.54-42.0.54-5
2.0.54-5sarge1
apache2
openSUSE:Tumbleweed
From an advisory covering 27 CVEs
 before 2.4.49-1.1
2.4.49-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitApache Module mod_rewrite LDAP Protocol Buffer Overflow2006-07-28
Exploit-DBApache < 1.3.37/2.0.59/2.2.3 mod_rewrite - Remote Overflow2006-08-21
Exploit-DBApache mod_rewrite (Windows x86) - Off-by-One Remote Overflow2007-04-07
Exploit-DBApache 2.0.58 mod_rewrite (Windows 2003) - Remote Overflow2007-05-26
Exploit-DBApache mod_rewrite - LDAP protocol Buffer Overflow (Metasploit)2010-02-15
PoC in GitHubdefensahacker/CVE-2006-37472016-11-26

History

History
RecordedChangedSources
affected, exploits, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-3747 is a high vulnerability (CVSS 7.6) in Apache Http Server, published July 28, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 97.1%, the 99th percentile. Fixed in apache2 2.0.55-4.1.

References

Show 128 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open