CVE-2004-0492
Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote...
Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.
- Record
CVE-2004-0492- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.
- Record
CVE-2004-0492- Updated
- 2026-11-02
EUVDEUVD-2004-0491 No score
Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.
- Record
EUVD-2004-0491- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w59m-3c5g-3v9c No score
Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote...
Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.
- Record
GHSA-w59m-3c5g-3v9c- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apacheDebian:3.0 |
before 1.3.26-0woody5 | 1.3.26-0woody5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-0492 is a high vulnerability (CVSS 10.0) in Apache Http Server, published June 23, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 33.6%, the 98th percentile. Fixed in apache 1.3.26-0woody5.
References
marc.info?l=bugtraq&m=108711172710140&w=2
bugzilla.fedora.us/show_bug.cgi?id=1737
rhn.redhat.com/errata/RHSA-2004-245.html
guninski.com/modproxy1.html
sunsolve.sun.com/search/document.do?assetkey=1-26-57628-1
Show 26 moreShow less
seclists.org/lists/fulldisclosure/2004/Jun/0296.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100112
mandriva.com/security/advisories?name=MDKSA-2004:065
debian.org/security/2004/dsa-525
kb.cert.org/vuls/id/541310
secunia.com/advisories/11841
exchange.xforce.ibmcloud.com/vulnerabilities/16387
lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2004-0492
github.com/advisories/GHSA-w59m-3c5g-3v9c