{"id":"CVE-2006-3918","aliases":["DEBIAN-CVE-2006-3918","DSA-1167-1","EUVD-2006-3912","GHSA-67m9-fpj8-vgmv","RHSA-2006:0619","RHSA-2008:0523","RHSA-2010:0602"],"status":"published","title":"http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache...","description":"http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.95145,"percentile":0.99864,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2006-07-28T00:00:00Z","modified":"2026-10-22T23:47:18Z","exploits":[{"source":"exploitdb","id":"EDB-28424","title":"Apache 1.3.35/2.0.58/2.2.2 - Arbitrary HTTP Request Headers Security","type":"remote","platform":"linux","date":"2006-08-24","verified":true,"url":"https://www.exploit-db.com/exploits/28424"}],"fixes":[{"ecosystem":"Debian:12","package":"apache2","fixed_in":["2.0.55-4.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache2","fixed_in":["2.0.55-4.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache2","fixed_in":["2.0.55-4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::as","package":"httpd","fixed_in":["0:2.0.46-61.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::as","package":"httpd-debuginfo","fixed_in":["0:2.0.46-61.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::as","package":"httpd-devel","fixed_in":["0:2.0.46-61.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::as","package":"mod_ssl","fixed_in":["1:2.0.46-61.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"httpd","fixed_in":["0:2.0.46-61.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"httpd-debuginfo","fixed_in":["0:2.0.46-61.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"httpd-devel","fixed_in":["0:2.0.46-61.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"mod_ssl","fixed_in":["1:2.0.46-61.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::es","package":"httpd","fixed_in":["0:2.0.46-61.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::es","package":"httpd-debuginfo","fixed_in":["0:2.0.46-61.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::es","package":"httpd-devel","fixed_in":["0:2.0.46-61.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::es","package":"mod_ssl","fixed_in":["1:2.0.46-61.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::ws","package":"httpd","fixed_in":["0:2.0.46-61.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::ws","package":"httpd-debuginfo","fixed_in":["0:2.0.46-61.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::ws","package":"httpd-devel","fixed_in":["0:2.0.46-61.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::ws","package":"mod_ssl","fixed_in":["1:2.0.46-61.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"httpd","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"httpd-debuginfo","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"httpd-devel","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"httpd-manual","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"httpd-suexec","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"mod_ssl","fixed_in":["1:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"httpd","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"httpd-debuginfo","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"httpd-devel","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"httpd-manual","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"httpd-suexec","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"mod_ssl","fixed_in":["1:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"httpd","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"httpd-debuginfo","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"httpd-devel","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"httpd-manual","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"httpd-suexec","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"mod_ssl","fixed_in":["1:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"httpd","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"httpd-debuginfo","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"httpd-devel","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"httpd-manual","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"httpd-suexec","fixed_in":["0:2.0.52-28.ent"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"mod_ssl","fixed_in":["1:2.0.52-28.ent"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.55-4.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.55-4.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.55-4.1"}]}]},{"source":"osv","ecosystem":"Debian:3.1","package":"apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.33-6sarge3"}]}],"versions":["1.3.33-6","1.3.33-6sarge1","1.3.33-6sarge2"],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.46-61.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.46-61.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.46-61.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.46-61.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.46-61.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.46-61.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.46-61.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.46-61.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.46-61.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.46-61.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.46-61.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.46-61.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.46-61.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.46-61.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.46-61.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.46-61.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"httpd-suexec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"httpd-suexec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"httpd-suexec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"httpd-suexec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.52-28.ent"}]}]},{"source":"osv","ecosystem":"Red Hat:network_proxy:4.2::el3","package":"jabberd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0s10-3.37.rhn"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:network_proxy:4.2::el3","package":"rhn-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.27-36.rhn.rhel3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:network_proxy:4.2::el3","package":"rhn-modperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29-16.rhel3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:network_proxy:4.2::el4","package":"jabberd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0s10-3.38.rhn"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:network_proxy:4.2::el4","package":"rhn-apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.27-36.rhn.rhel4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:network_proxy:4.2::el4","package":"rhn-modperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29-16.rhel4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"ant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1jpp_1rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"avalon-logkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2-2jpp_4rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1jpp_3rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"classpathx-jaf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0-2jpp_6rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"classpathx-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.1-2jpp_8rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"geronimo-ejb-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0-0.M4.1jpp_10rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"geronimo-j2ee-1.4-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0-0.M4.1jpp_10rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"geronimo-j2ee-connector-1.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0-0.M4.1jpp_10rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"geronimo-j2ee-deployment-1.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0-0.M4.1jpp_10rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"geronimo-j2ee-management-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0-0.M4.1jpp_10rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"geronimo-jms-1.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0-0.M4.1jpp_10rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"geronimo-jsp-2.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0-0.M4.1jpp_10rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"geronimo-jta-1.0.1B-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0-0.M4.1jpp_10rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"geronimo-servlet-2.4-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0-0.M4.1jpp_10rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0-0.M4.1jpp_10rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"geronimo-specs-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0-0.M4.1jpp_10rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"jakarta-commons-modeler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0-3jpp_2rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1jpp_1rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"mx4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-1jpp_4rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"pcsc-lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-3.el4"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"pcsc-lite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-3.el4"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"pcsc-lite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-3.el4"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"pcsc-lite-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-3.el4"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"rhpki-ca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.0-20.el4"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"rhpki-java-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.0-10.el4"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"rhpki-kra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.0-14.el4"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"rhpki-manage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.0-19.el4"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"rhpki-native-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.0-6.el4"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"rhpki-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.0-13.el4"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"rhpki-tks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.0-13.el4"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"tomcat5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.16"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"tomcat5-common-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.16"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"tomcat5-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.16"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"tomcat5-jsp-2.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.16"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"tomcat5-server-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.16"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"tomcat5-servlet-2.4-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.16"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-1jpp_1rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"xml-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.02-2jpp_1rh"}]}],"bundled":39},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"xml-commons-apis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.02-2jpp_1rh"}]}],"bundled":39}],"products":[{"vendor":"apache","product":"http_server"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P","tags":["vendor-advisory","x_refsource_SGI","x_transferred","Broken Link","advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/1572","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Permissions Required","report"]},{"url":"http://svn.apache.org/viewvc?view=rev\u0026revision=394965","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","evidence"]},{"url":"http://secunia.com/advisories/28749","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Not Applicable","advisory"]},{"url":"http://www.f-secure.com/en_EMEA/support/security-advisory/fsc-2010-2.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2006/dsa-1167","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/19661","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://secunia.com/advisories/21744","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Not Applicable","advisory"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2006-07/0425.html","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Exploit","evidence","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=125631037611762\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Issue Tracking","Mailing List","Third Party Advisory","advisory","article","report"]},{"url":"http://www.securitytracker.com/id?1024144","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://secunia.com/advisories/22317","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Not Applicable","advisory"]},{"url":"http://secunia.com/advisories/22523","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Not Applicable","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=130497311408250\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Issue Tracking","Mailing List","Third Party Advisory","advisory","article","report"]},{"url":"http://www.vupen.com/english/advisories/2006/5089","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Permissions Required","report"]},{"url":"http://www.vupen.com/english/advisories/2006/3264","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Permissions Required","report"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2006-05/0151.html","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Exploit","evidence","web"]},{"url":"http://secunia.com/advisories/21598","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Not Applicable","advisory"]},{"url":"http://secunia.com/advisories/21399","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Not Applicable","advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10352","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","Third Party Advisory","advisory"]},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2006-194.htm","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/21478","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Not Applicable","advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2006-0619.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/21986","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Not Applicable","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=129190899612998\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Issue Tracking","Mailing List","Third Party Advisory","advisory","article","report"]},{"url":"http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18\u0026ID=3117","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","web"]},{"url":"http://www.vupen.com/english/advisories/2006/4207","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Permissions Required","report"]},{"url":"http://secunia.com/advisories/21848","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Not Applicable","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2006-0618.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www-1.ibm.com/support/docview.wss?uid=swg1PK24631","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://rhn.redhat.com/errata/RHSA-2006-0692.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/40256","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Not Applicable","advisory"]},{"url":"http://www.novell.com/linux/security/advisories/2006_51_apache.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.vupen.com/english/advisories/2006/2963","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Permissions Required","report"]},{"url":"http://secunia.com/advisories/21174","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Not Applicable","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.ubuntu.com/usn/usn-575-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12238","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/29640","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Not Applicable","advisory"]},{"url":"http://securityreason.com/securityalert/1294","tags":["third-party-advisory","x_refsource_SREASON","x_transferred","Exploit","Third Party Advisory","advisory","evidence"]},{"url":"http://openbsd.org/errata.html#httpd2","tags":["vendor-advisory","x_refsource_OPENBSD","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www-1.ibm.com/support/docview.wss?uid=swg24013080","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/21172","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Not Applicable","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://kb.vmware.com/KanisaPlatform/Publishing/466/5915871_f.SAL_Public.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://securitytracker.com/id?1016569","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://www.vupen.com/english/advisories/2006/2964","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Permissions Required","report"]},{"url":"http://secunia.com/advisories/22140","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Not Applicable","advisory"]},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-3918","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-67m9-fpj8-vgmv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2006-3918","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2006:0619","tags":["advisory"]},{"url":"http://www.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=200732","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0619.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2006-3918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-3918","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2008:0523","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=449336","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0523.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2004-0488","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=430867","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2004-0488","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-0488","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2004-0700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=430866","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2004-0700","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-0700","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2004-0885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=430637","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2004-0885","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-0885","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2005-3352","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=430524","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-3352","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-3352","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2006-1329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=429254","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-1329","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-1329","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2006-5752","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=245112","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-5752","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-5752","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-1349","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=240423","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-1349","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-1349","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-3304","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=245111","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-3304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-3304","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-4465","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=289511","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-4465","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-4465","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-5000","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=419931","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-5000","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-5000","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-6388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=427228","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-6388","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-6388","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2010:0602","tags":["advisory"]},{"url":"http://www.redhat.com/docs/manuals/cert-system/7.3/html/Administration_Guide/Administration_Guide-Updating_Certificate_System_Packages-Updating_a_Solaris_9_system_using_pkgrm_and_pkgadd.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=237079","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=237080","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=237084","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=237085","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=244658","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=244803","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=247972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=247976","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=250731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=323571","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=333791","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=427739","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=427766","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=429821","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=443928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=451615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=457597","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=457934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=458250","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=493381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=503928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=503978","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=504390","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=504555","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=504753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=509125","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=515698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=521619","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=522209","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=570171","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=596426","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0602.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2005-2090","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-2090","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-2090","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2005-3510","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-3510","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-3510","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2006-3835","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-3835","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-3835","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-0450","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-0450","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-0450","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-1358","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-1358","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-1358","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-1863","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-1863","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-1863","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-3382","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-3382","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-3382","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-3385","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-3385","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-3385","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-3847","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-3847","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-3847","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-5116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-5116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-5116","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-5333","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-5333","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-5333","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-5461","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-5461","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-5461","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-0005","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-0005","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-0005","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-0128","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-0128","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-0128","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-1232","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-1232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-1232","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-1927","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-1927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-1927","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-2364","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-2364","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-2364","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-2370","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-2370","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-2370","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-2939","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-2939","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-2939","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-5515","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-5515","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-5515","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-0023","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-0023","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0023","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-0033","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-0033","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0033","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-0580","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-0580","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0580","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1891","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1891","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1891","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1955","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1955","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1955","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1956","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1956","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1956","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2412","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2412","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2412","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-3094","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3094","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3094","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-3095","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3095","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3095","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-4901","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-4901","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-4901","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-0407","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-0407","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-0407","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-0434","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-0434","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-0434","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2006-3918","description":"http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.","status":"published","published":"2006-07-28T00:00:00Z","modified":"2024-08-07T18:48:39.41Z","updated_at":"2026-11-02T14:33:49.62488Z"}],"euvd":[{"id":"EUVD-2006-3912","description":"http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.","status":"published","published":"2006-07-28T00:00:00Z","modified":"2024-08-07T18:48:39Z","updated_at":"2026-11-03T01:15:54.485555Z"}],"ghsa":[{"id":"GHSA-67m9-fpj8-vgmv","title":"http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache...","description":"http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.","status":"published","published":"2022-05-03T03:16:18Z","modified":"2023-02-01T05:01:19Z","updated_at":"2026-11-02T14:49:42.191398Z"}],"nvd":[{"id":"CVE-2006-3918","description":"http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.","status":"published","published":"2006-07-28T00:04:00Z","modified":"2026-06-16T22:28:04.5Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:01:05.130518Z"}],"osv":[{"id":"CVE-2006-3918","description":"http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.","status":"published","published":"2006-07-28T00:04:00Z","modified":"2026-04-10T03:37:42.912896Z","updated_at":"2026-11-02T15:43:56.865964Z"},{"id":"DEBIAN-CVE-2006-3918","description":"http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.","status":"published","published":"2006-07-28T00:04:00Z","modified":"2026-10-22T23:47:18.764627496Z","updated_at":"2026-11-02T15:45:23.105674Z"},{"id":"DSA-1167-1","title":"apache - missing input sanitising","status":"published","published":"2006-09-04T00:00:00Z","modified":"2026-03-09T01:00:57.931604Z","updated_at":"2026-11-02T15:46:14.285228Z"},{"id":"RHSA-2006:0619","title":"Red Hat Security Advisory: httpd security update","status":"published","published":"2024-09-13T06:22:39Z","modified":"2026-06-29T10:01:26Z","updated_at":"2026-11-02T15:52:59.135214Z"},{"id":"RHSA-2008:0523","title":"Red Hat Security Advisory: Red Hat Network Proxy Server security update","status":"published","published":"2024-09-15T17:20:07Z","modified":"2026-06-29T10:01:59Z","updated_at":"2026-11-02T15:52:59.70892Z"},{"id":"RHSA-2010:0602","title":"Red Hat Security Advisory: Red Hat Certificate System 7.3 security update","status":"published","published":"2024-09-15T18:26:51Z","modified":"2026-06-29T10:03:31Z","updated_at":"2026-11-02T15:53:01.003286Z"}]}}