Every CVESearch/Get API key

CVE-2003-0189

The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle...

5.0 MediumFix available

CVE-2003-0189 is a medium vulnerability (CVSS 5.0) in Apache Http Server, published May 30, 2003. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 15.1%, the 96th percentile. Fixed in apache2 2.0.46.

What does this mean?
Severity
5.0 MediumCVSS 2.0, NVD
Exploit chance
15.1%EPSS, 96th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.0.46apache2 +2 more

Description

The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions, which allows remote attackers to cause a denial of service (failed Basic authentication with valid usernames and passwords) when a threaded MPM is used.

Exploit likelihood

15.1%Up 7.8 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Debian:12
before 2.0.46
2.0.46
apache2
Debian:13
before 2.0.46
2.0.46
apache2
Debian:14
before 2.0.46
2.0.46

What each source reports

NVD Score used5.0

The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions, which allows remote attackers to cause a denial of service (failed Basic authentication with valid usernames and passwords) when a threaded MPM is used.

Record
CVE-2003-0189
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated
2026-11-02
CVE ListNo score

The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions, which allows remote attackers to cause a denial of service (failed Basic authentication with valid usernames and passwords) when a threaded MPM is used.

Record
CVE-2003-0189
Updated
2026-11-02
EUVDEUVD-2003-0185No score

The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions, which allows remote attackers to cause a denial of service (failed Basic authentication with valid usernames and passwords) when a threaded MPM is used.

Record
EUVD-2003-0185
Updated
2026-11-03
GitHub AdvisoriesGHSA-88hg-mqww-hqj3No score

The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle...

The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions, which allows remote attackers to cause a denial of service (failed Basic authentication with valid usernames and passwords) when a threaded MPM is used.

Record
GHSA-88hg-mqww-hqj3
Updated
2026-11-02
OSVBELL-CVE-2003-01895.0

CVE-2003-0189 does not affect BellSoft software

Record
BELL-CVE-2003-0189
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated
2026-11-02
OSVNo score

The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions, which allows remote attackers to cause a denial of service (failed Basic authentication with valid usernames and passwords) when a threaded MPM is used.

Record
CVE-2003-0189
Updated
2026-11-02
OSVDEBIAN-CVE-2003-0189No score

The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions, which allows remote attackers to cause a denial of service (failed Basic authentication with valid usernames and passwords) when a threaded MPM is used.

Record
DEBIAN-CVE-2003-0189
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 34 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open