CVE-2015-0253
The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not...
The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.
Exploit likelihood
What each source reports
NVD Score used
The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.
- Record
CVE-2015-0253- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.
- Record
CVE-2015-0253- Updated
- 2026-11-02
EUVDEUVD-2015-0274 No score
The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.
- Record
EUVD-2015-0274- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4g3x-jprw-h46m No score
The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not...
The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.
- Record
GHSA-4g3x-jprw-h46m- Updated
- 2026-11-02
OSVBELL-CVE-2015-0253
CVE-2015-0253 does not affect BellSoft software
- Record
BELL-CVE-2015-0253- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
OSVRHSA-2015:1666
Red Hat Security Advisory: httpd24-httpd security update
- Record
RHSA-2015:1666- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10268-1 No score
apache2-2.4.23-4.1 on GA media
These are all security issues fixed in the apache2-2.4.23-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10268-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
httpd24-httpdRed Hat:rhel_software_collections:2::el6 From an advisory covering 4 CVEs |
before 0:2.4.12-4.el6.2 | 0:2.4.12-4.el6.2 |
httpd24-httpd-debuginfoRed Hat:rhel_software_collections:2::el6 From an advisory covering 4 CVEs |
before 0:2.4.12-4.el6.2 | 0:2.4.12-4.el6.2 |
httpd24-httpd-develRed Hat:rhel_software_collections:2::el6 From an advisory covering 4 CVEs |
before 0:2.4.12-4.el6.2 | 0:2.4.12-4.el6.2 |
httpd24-httpd-manualRed Hat:rhel_software_collections:2::el6 From an advisory covering 4 CVEs |
before 0:2.4.12-4.el6.2 | 0:2.4.12-4.el6.2 |
httpd24-httpd-toolsRed Hat:rhel_software_collections:2::el6 From an advisory covering 4 CVEs |
before 0:2.4.12-4.el6.2 | 0:2.4.12-4.el6.2 |
httpd24-mod_ldapRed Hat:rhel_software_collections:2::el6 From an advisory covering 4 CVEs |
before 0:2.4.12-4.el6.2 | 0:2.4.12-4.el6.2 |
httpd24-mod_proxy_htmlRed Hat:rhel_software_collections:2::el6 From an advisory covering 4 CVEs |
before 1:2.4.12-4.el6.2 | 1:2.4.12-4.el6.2 |
httpd24-mod_sessionRed Hat:rhel_software_collections:2::el6 From an advisory covering 4 CVEs |
before 0:2.4.12-4.el6.2 | 0:2.4.12-4.el6.2 |
httpd24-mod_sslRed Hat:rhel_software_collections:2::el6 From an advisory covering 4 CVEs |
before 1:2.4.12-4.el6.2 | 1:2.4.12-4.el6.2 |
httpd24-httpdRed Hat:rhel_software_collections:2::el7 From an advisory covering 4 CVEs |
before 0:2.4.12-6.el7.1 | 0:2.4.12-6.el7.1 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
httpd24-httpd-debuginfoRed Hat:rhel_software_collections:2::el7 From an advisory covering 4 CVEs |
before 0:2.4.12-6.el7.1 | 0:2.4.12-6.el7.1 |
httpd24-httpd-develRed Hat:rhel_software_collections:2::el7 From an advisory covering 4 CVEs |
before 0:2.4.12-6.el7.1 | 0:2.4.12-6.el7.1 |
httpd24-httpd-manualRed Hat:rhel_software_collections:2::el7 From an advisory covering 4 CVEs |
before 0:2.4.12-6.el7.1 | 0:2.4.12-6.el7.1 |
httpd24-httpd-toolsRed Hat:rhel_software_collections:2::el7 From an advisory covering 4 CVEs |
before 0:2.4.12-6.el7.1 | 0:2.4.12-6.el7.1 |
httpd24-mod_ldapRed Hat:rhel_software_collections:2::el7 From an advisory covering 4 CVEs |
before 0:2.4.12-6.el7.1 | 0:2.4.12-6.el7.1 |
httpd24-mod_proxy_htmlRed Hat:rhel_software_collections:2::el7 From an advisory covering 4 CVEs |
before 1:2.4.12-6.el7.1 | 1:2.4.12-6.el7.1 |
httpd24-mod_sessionRed Hat:rhel_software_collections:2::el7 From an advisory covering 4 CVEs |
before 0:2.4.12-6.el7.1 | 0:2.4.12-6.el7.1 |
httpd24-mod_sslRed Hat:rhel_software_collections:2::el7 From an advisory covering 4 CVEs |
before 1:2.4.12-6.el7.1 | 1:2.4.12-6.el7.1 |
apache2openSUSE:Tumbleweed From an advisory covering 48 CVEs |
before 2.4.23-4.1 | 2.4.23-4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0253 is a medium vulnerability (CVSS 5.0) in Apache Http Server, published July 20, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.8%, the 96th percentile. No source names a fixed version.
References
bz.apache.org/bugzilla/show_bug.cgi?id=57531
httpd.apache.org/security/vulnerabilities_24.html
github.com/apache/httpd/commit/6a974059190b8a0c7e499f4ab12fe108127099cb
oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
apache.org/dist/httpd/CHANGES_2.4
rhn.redhat.com/errata/RHSA-2015-1666.html
Show 103 moreShow less
securitytracker.com/id/1032967
lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
securityfocus.com/bid/75964
support.apple.com/kb/HT205031
lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2015-0253
docs.bell-sw.com/security/cves/CVE-2015-0253
access.redhat.com/errata/RHSA-2015:1666
bugzilla.redhat.com/show_bug.cgi?id=1202988
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1666.json
cve.org/CVERecord?id=CVE-2015-0228
suse.com/security/cve/CVE-2009-0023