Every CVE Search/ Get API key

CVE-2006-3918

http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache...

4.3 MediumPublic exploitFix available

http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

Exploit likelihood

95.1%Up 17.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

Record
CVE-2006-3918
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

Record
CVE-2006-3918
Updated
2026-11-02
EUVDEUVD-2006-3912 No score

http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

Record
EUVD-2006-3912
Updated
2026-11-03
GitHub AdvisoriesGHSA-67m9-fpj8-vgmv No score

http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache...

http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

Record
GHSA-67m9-fpj8-vgmv
Updated
2026-11-02
OSV No score

http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

Record
CVE-2006-3918
Updated
2026-11-02
OSVDEBIAN-CVE-2006-3918 No score

http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

Record
DEBIAN-CVE-2006-3918
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Debian:12
 before 2.0.55-4.1
2.0.55-4.1
apache2
Debian:13
 before 2.0.55-4.1
2.0.55-4.1
apache2
Debian:14
 before 2.0.55-4.1
2.0.55-4.1
apache
Debian:3.1
From an advisory covering 2 CVEs
 before 1.3.33-6sarge3, plus listed versions
1.3.33-61.3.33-6sarge11.3.33-6sarge2
1.3.33-6sarge3
httpd
Red Hat:enterprise_linux:3::as
 before 0:2.0.46-61.ent
0:2.0.46-61.ent
httpd-debuginfo
Red Hat:enterprise_linux:3::as
 before 0:2.0.46-61.ent
0:2.0.46-61.ent
httpd-devel
Red Hat:enterprise_linux:3::as
 before 0:2.0.46-61.ent
0:2.0.46-61.ent
mod_ssl
Red Hat:enterprise_linux:3::as
 before 1:2.0.46-61.ent
1:2.0.46-61.ent
httpd
Red Hat:enterprise_linux:3::desktop
 before 0:2.0.46-61.ent
0:2.0.46-61.ent
httpd-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 0:2.0.46-61.ent
0:2.0.46-61.ent
Show 79 moreShow less
Affected packages
PackageAffectedFixed
httpd-devel
Red Hat:enterprise_linux:3::desktop
 before 0:2.0.46-61.ent
0:2.0.46-61.ent
mod_ssl
Red Hat:enterprise_linux:3::desktop
 before 1:2.0.46-61.ent
1:2.0.46-61.ent
httpd
Red Hat:enterprise_linux:3::es
 before 0:2.0.46-61.ent
0:2.0.46-61.ent
httpd-debuginfo
Red Hat:enterprise_linux:3::es
 before 0:2.0.46-61.ent
0:2.0.46-61.ent
httpd-devel
Red Hat:enterprise_linux:3::es
 before 0:2.0.46-61.ent
0:2.0.46-61.ent
mod_ssl
Red Hat:enterprise_linux:3::es
 before 1:2.0.46-61.ent
1:2.0.46-61.ent
httpd
Red Hat:enterprise_linux:3::ws
 before 0:2.0.46-61.ent
0:2.0.46-61.ent
httpd-debuginfo
Red Hat:enterprise_linux:3::ws
 before 0:2.0.46-61.ent
0:2.0.46-61.ent
httpd-devel
Red Hat:enterprise_linux:3::ws
 before 0:2.0.46-61.ent
0:2.0.46-61.ent
mod_ssl
Red Hat:enterprise_linux:3::ws
 before 1:2.0.46-61.ent
1:2.0.46-61.ent
httpd
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
httpd-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
httpd-devel
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
httpd-manual
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
httpd-suexec
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
mod_ssl
Red Hat:enterprise_linux:4::as
 before 1:2.0.52-28.ent
1:2.0.52-28.ent
httpd
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
httpd-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
httpd-devel
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
httpd-manual
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
httpd-suexec
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
mod_ssl
Red Hat:enterprise_linux:4::desktop
 before 1:2.0.52-28.ent
1:2.0.52-28.ent
httpd
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
httpd-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
httpd-devel
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
httpd-manual
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
httpd-suexec
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
mod_ssl
Red Hat:enterprise_linux:4::es
 before 1:2.0.52-28.ent
1:2.0.52-28.ent
httpd
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
httpd-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
httpd-devel
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
httpd-manual
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
httpd-suexec
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-28.ent
0:2.0.52-28.ent
mod_ssl
Red Hat:enterprise_linux:4::ws
 before 1:2.0.52-28.ent
1:2.0.52-28.ent
jabberd
Red Hat:network_proxy:4.2::el3
From an advisory covering 12 CVEs
 before 0:2.0s10-3.37.rhn
0:2.0s10-3.37.rhn
rhn-apache
Red Hat:network_proxy:4.2::el3
From an advisory covering 12 CVEs
 before 0:1.3.27-36.rhn.rhel3
0:1.3.27-36.rhn.rhel3
rhn-modperl
Red Hat:network_proxy:4.2::el3
From an advisory covering 12 CVEs
 before 0:1.29-16.rhel3
0:1.29-16.rhel3
jabberd
Red Hat:network_proxy:4.2::el4
From an advisory covering 12 CVEs
 before 0:2.0s10-3.38.rhn
0:2.0s10-3.38.rhn
rhn-apache
Red Hat:network_proxy:4.2::el4
From an advisory covering 12 CVEs
 before 0:1.3.27-36.rhn.rhel4
0:1.3.27-36.rhn.rhel4
rhn-modperl
Red Hat:network_proxy:4.2::el4
From an advisory covering 12 CVEs
 before 0:1.29-16.rhel4
0:1.29-16.rhel4
ant
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.6.5-1jpp_1rh
0:1.6.5-1jpp_1rh
avalon-logkit
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.2-2jpp_4rh
0:1.2-2jpp_4rh
axis
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.2.1-1jpp_3rh
0:1.2.1-1jpp_3rh
classpathx-jaf
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.0-2jpp_6rh
0:1.0-2jpp_6rh
classpathx-mail
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.1.1-2jpp_8rh
0:1.1.1-2jpp_8rh
geronimo-ejb-2.1-api
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.0-0.M4.1jpp_10rh
0:1.0-0.M4.1jpp_10rh
geronimo-j2ee-1.4-apis
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.0-0.M4.1jpp_10rh
0:1.0-0.M4.1jpp_10rh
geronimo-j2ee-connector-1.5-api
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.0-0.M4.1jpp_10rh
0:1.0-0.M4.1jpp_10rh
geronimo-j2ee-deployment-1.1-api
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.0-0.M4.1jpp_10rh
0:1.0-0.M4.1jpp_10rh
geronimo-j2ee-management-1.0-api
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.0-0.M4.1jpp_10rh
0:1.0-0.M4.1jpp_10rh
geronimo-jms-1.1-api
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.0-0.M4.1jpp_10rh
0:1.0-0.M4.1jpp_10rh
geronimo-jsp-2.0-api
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.0-0.M4.1jpp_10rh
0:1.0-0.M4.1jpp_10rh
geronimo-jta-1.0.1B-api
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.0-0.M4.1jpp_10rh
0:1.0-0.M4.1jpp_10rh
geronimo-servlet-2.4-api
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.0-0.M4.1jpp_10rh
0:1.0-0.M4.1jpp_10rh
geronimo-specs
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.0-0.M4.1jpp_10rh
0:1.0-0.M4.1jpp_10rh
geronimo-specs-javadoc
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.0-0.M4.1jpp_10rh
0:1.0-0.M4.1jpp_10rh
jakarta-commons-modeler
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:2.0-3jpp_2rh
0:2.0-3jpp_2rh
log4j
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.2.12-1jpp_1rh
0:1.2.12-1jpp_1rh
mx4j
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 1:3.0.1-1jpp_4rh
1:3.0.1-1jpp_4rh
pcsc-lite
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.3.3-3.el4
0:1.3.3-3.el4
pcsc-lite-debuginfo
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.3.3-3.el4
0:1.3.3-3.el4
pcsc-lite-doc
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.3.3-3.el4
0:1.3.3-3.el4
pcsc-lite-libs
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.3.3-3.el4
0:1.3.3-3.el4
rhpki-ca
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:7.3.0-20.el4
0:7.3.0-20.el4
rhpki-java-tools
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:7.3.0-10.el4
0:7.3.0-10.el4
rhpki-kra
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:7.3.0-14.el4
0:7.3.0-14.el4
rhpki-manage
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:7.3.0-19.el4
0:7.3.0-19.el4
rhpki-native-tools
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:7.3.0-6.el4
0:7.3.0-6.el4
rhpki-ocsp
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:7.3.0-13.el4
0:7.3.0-13.el4
rhpki-tks
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:7.3.0-13.el4
0:7.3.0-13.el4
tomcat5
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:5.5.23-0jpp_4rh.16
0:5.5.23-0jpp_4rh.16
tomcat5-common-lib
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:5.5.23-0jpp_4rh.16
0:5.5.23-0jpp_4rh.16
tomcat5-jasper
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:5.5.23-0jpp_4rh.16
0:5.5.23-0jpp_4rh.16
tomcat5-jsp-2.0-api
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:5.5.23-0jpp_4rh.16
0:5.5.23-0jpp_4rh.16
tomcat5-server-lib
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:5.5.23-0jpp_4rh.16
0:5.5.23-0jpp_4rh.16
tomcat5-servlet-2.4-api
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:5.5.23-0jpp_4rh.16
0:5.5.23-0jpp_4rh.16
xerces-j2
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:2.7.1-1jpp_1rh
0:2.7.1-1jpp_1rh
xml-commons
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.3.02-2jpp_1rh
0:1.3.02-2jpp_1rh
xml-commons-apis
Red Hat:certificate_system:7.3
From an advisory covering 39 CVEs
 before 0:1.3.02-2jpp_1rh
0:1.3.02-2jpp_1rh

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBApache 1.3.35/2.0.58/2.2.2 - Arbitrary HTTP Request Headers Security2006-08-24

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-3918 is a medium vulnerability (CVSS 4.3) in Apache Http Server, published July 28, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 95.1%, the 99th percentile. Fixed in apache2 2.0.55-4.1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 51 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open