CVE-2004-0113
Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to...
CVE-2004-0113 is a medium vulnerability (CVSS 5.0) in Apache Http Server, published March 29, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.0%, the 95th percentile. Fixed in apache2 2.0.52.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 11.0%EPSS, 95th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.52apache2 +18 more
Description
Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache2Debian:12 | before 2.0.52 | 2.0.52 |
apache2Debian:13 | before 2.0.52 | 2.0.52 |
apache2Debian:14 | before 2.0.52 | 2.0.52 |
httpdRed Hat:enterprise_linux:3::as | before 0:2.0.46-32.ent | 0:2.0.46-32.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::as | before 0:2.0.46-32.ent | 0:2.0.46-32.ent |
httpd-develRed Hat:enterprise_linux:3::as | before 0:2.0.46-32.ent | 0:2.0.46-32.ent |
mod_sslRed Hat:enterprise_linux:3::as | before 1:2.0.46-32.ent | 1:2.0.46-32.ent |
httpdRed Hat:enterprise_linux:3::desktop | before 0:2.0.46-32.ent | 0:2.0.46-32.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::desktop | before 0:2.0.46-32.ent | 0:2.0.46-32.ent |
httpd-develRed Hat:enterprise_linux:3::desktop | before 0:2.0.46-32.ent | 0:2.0.46-32.ent |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mod_sslRed Hat:enterprise_linux:3::desktop | before 1:2.0.46-32.ent | 1:2.0.46-32.ent |
httpdRed Hat:enterprise_linux:3::es | before 0:2.0.46-32.ent | 0:2.0.46-32.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::es | before 0:2.0.46-32.ent | 0:2.0.46-32.ent |
httpd-develRed Hat:enterprise_linux:3::es | before 0:2.0.46-32.ent | 0:2.0.46-32.ent |
mod_sslRed Hat:enterprise_linux:3::es | before 1:2.0.46-32.ent | 1:2.0.46-32.ent |
httpdRed Hat:enterprise_linux:3::ws | before 0:2.0.46-32.ent | 0:2.0.46-32.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::ws | before 0:2.0.46-32.ent | 0:2.0.46-32.ent |
httpd-develRed Hat:enterprise_linux:3::ws | before 0:2.0.46-32.ent | 0:2.0.46-32.ent |
mod_sslRed Hat:enterprise_linux:3::ws | before 1:2.0.46-32.ent | 1:2.0.46-32.ent |
What each source reports
NVD Score used
Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.
- Record
CVE-2004-0113- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE ListNo score
Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.
- Record
CVE-2004-0113- Updated
- 2026-11-02
EUVDEUVD-2004-0113No score
Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.
- Record
EUVD-2004-0113- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hq2q-rqpw-7wx5No score
Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to...
Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.
- Record
GHSA-hq2q-rqpw-7wx5- Updated
- 2026-11-02
OSVBELL-CVE-2004-0113
CVE-2004-0113 does not affect BellSoft software
- Record
BELL-CVE-2004-0113- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
OSVNo score
Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.
- Record
CVE-2004-0113- Updated
- 2026-11-02
OSVDEBIAN-CVE-2004-0113No score
Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.
- Record
DEBIAN-CVE-2004-0113- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
marc.info?l=bugtraq&m=108369640424244&w=2
apacheweek.com/features/security-20
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A876
redhat.com/support/errata/RHSA-2004-182.html
Show 53 moreShow less
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000839
issues.apache.org/bugzilla/show_bug.cgi?id=27106
securityfocus.com/bid/9826
trustix.org/errata/2004/0017
security.gentoo.org/glsa/glsa-200403-04.xml
exchange.xforce.ibmcloud.com/vulnerabilities/15419
mandrakesoft.com/security/advisories?name=MDKSA-2004:043
osvdb.org/4182
lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2004-0113
github.com/advisories/GHSA-hq2q-rqpw-7wx5
docs.bell-sw.com/security/cves/CVE-2004-0113
security-tracker.debian.org/tracker/CVE-2004-0113
access.redhat.com/errata/RHSA-2004:084
nagoya.apache.org/bugzilla/show_bug.cgi?id=27106
bugzilla.redhat.com/show_bug.cgi?id=112771
security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_084.json
cve.org/CVERecord?id=CVE-2004-0113