{"id":"CVE-2014-0117","aliases":["BELL-CVE-2014-0117","DEBIAN-CVE-2014-0117","EUVD-2014-0187","GHSA-8qwx-34pp-wp2m","MGASA-2014-0305","RHSA-2014:0921","RHSA-2014:0922","UBUNTU-CVE-2014-0117","USN-2299-1","openSUSE-SU-2024:10268-1"],"status":"published","title":"The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is...","description":"The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.35677,"percentile":0.98471,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2014-07-20T00:00:00Z","modified":"2026-10-23T15:47:25Z","fixes":[{"ecosystem":"Debian:12","package":"apache2","fixed_in":["2.4.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache2","fixed_in":["2.4.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache2","fixed_in":["2.4.10-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"apache2","fixed_in":["2.4.7-1ubuntu4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-5.3.mga4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el7_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-18.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-18.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-18.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el7","package":"httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-21.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el7","package":"httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-21.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el7","package":"httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-21.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el7","package":"httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-21.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el7","package":"httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-21.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el7","package":"httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-21.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el7","package":"httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-21.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el7","package":"httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-21.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el7","package":"httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-21.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu4.1"}]}],"versions":["2.4.6-2ubuntu2","2.4.6-2ubuntu3","2.4.6-2ubuntu4","2.4.7-1ubuntu1","2.4.7-1ubuntu2","2.4.7-1ubuntu3","2.4.7-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu4.1"}]}],"versions":["2.4.6-2ubuntu2","2.4.6-2ubuntu3","2.4.6-2ubuntu4","2.4.7-1ubuntu1","2.4.7-1ubuntu2","2.4.7-1ubuntu3","2.4.7-1ubuntu4"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-4.1"}]}],"bundled":48}],"products":[{"vendor":"apache","product":"http_server"},{"vendor":"apple","product":"mac_os_x"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1120599","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://advisories.mageia.org/MGASA-2014-0305.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://support.apple.com/HT204659","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://httpd.apache.org/security/vulnerabilities_24.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web","article","report"]},{"url":"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c?r1=1609680\u0026r2=1610674\u0026diff_format=h","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://zerodayinitiative.com/advisories/ZDI-14-239/","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2014/Jul/117","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=1599486\u0026r2=1610674\u0026diff_format=h","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0117","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"},{"url":"http://zerodayinitiative.com/advisories/ZDI-14-239"},{"url":"https://github.com/advisories/GHSA-8qwx-34pp-wp2m"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2014-0117","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-0117","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0305.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13788","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-0921.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0921","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1120596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1120601","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1120603","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1120604","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0921.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4352","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4352","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4352","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0117","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0117","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0118","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0118","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0118","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0226","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0226","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0226","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0231","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0231","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0231","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0922","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0922.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-0117","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2299-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-0118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0231","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4979","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-0117","description":"The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.","status":"published","published":"2014-07-20T10:00:00Z","modified":"2024-08-06T09:05:38.974Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2014-0187","description":"The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.","status":"published","published":"2014-07-20T10:00:00Z","modified":"2024-08-06T09:05:38Z","updated_at":"2026-11-03T01:57:22.468358Z"}],"ghsa":[{"id":"GHSA-8qwx-34pp-wp2m","title":"The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is...","description":"The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.","status":"published","published":"2022-05-13T01:09:48Z","modified":"2025-04-12T12:35:57Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:17.900782Z"}],"nvd":[{"id":"CVE-2014-0117","description":"The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.","status":"published","published":"2014-07-20T11:12:48.823Z","modified":"2026-06-17T00:02:19.017Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:54.827864Z"}],"osv":[{"id":"BELL-CVE-2014-0117","title":"CVE-2014-0117 does not affect BellSoft software","status":"withdrawn","published":"2014-07-20T11:12:00Z","modified":"2026-01-28T07:20:14.073569Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2014-0117","description":"The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.","status":"published","published":"2014-07-20T11:12:48Z","modified":"2026-04-16T06:21:19.232117566Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-0117","description":"The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.","status":"published","published":"2014-07-20T11:12:48.823Z","modified":"2026-10-23T15:47:25.455515566Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"MGASA-2014-0305","title":"Updated apache package fixes security vulnerabilities","description":"A race condition flaw, leading to heap-based buffer overflows, was found in\nthe mod_status httpd module. A remote attacker able to access a status page\nserved by mod_status on a server using a threaded Multi-Processing Module\n(MPM) could send a specially crafted request that would cause the httpd\nchild process to crash or, possibly, allow the attacker to execute\narbitrary code with the privileges of the \"apache\" user (CVE-2014-0226).\n\nA denial of service flaw was found in the mod_proxy httpd module. A remote\nattacker could send a specially crafted request to a server configured as a\nreverse proxy using a threaded Multi-Processing Modules (MPM) that would\ncause the httpd child process to crash (CVE-2014-0117).\n\nA denial of service flaw was found in the way httpd's mod_deflate module\nhandled request body decompression (configured via the \"DEFLATE\" input\nfilter). A remote attacker able to send a request whose body would be\ndecompressed could use this flaw to consume an excessive amount of system\nmemory and CPU on the target system (CVE-2014-0118).\n\nA denial of service flaw was found in the way httpd's mod_cgid module\nexecuted CGI scripts that did not read data from the standard input.\nA remote attacker could submit a specially crafted request that would cause\nthe httpd child process to hang indefinitely (CVE-2014-0231).\n","status":"published","published":"2014-07-29T21:30:55Z","modified":"2026-04-16T06:23:59.560905923Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10268-1","title":"apache2-2.4.23-4.1 on GA media","description":"These are all security issues fixed in the apache2-2.4.23-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:25:01.364403Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2014:0921","title":"Red Hat Security Advisory: httpd security update","status":"published","published":"2024-09-13T08:54:30Z","modified":"2026-08-05T10:02:41Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:0922","title":"Red Hat Security Advisory: httpd24-httpd security update","status":"published","published":"2024-09-13T08:54:40Z","modified":"2026-08-05T10:02:42Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"UBUNTU-CVE-2014-0117","description":"The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.","status":"published","published":"2014-07-20T00:00:00Z","modified":"2026-04-22T09:27:38.293786Z","updated_at":"2026-11-02T15:54:07.855521Z"},{"id":"USN-2299-1","title":"apache2 vulnerabilities","description":"Marek Kroemeke discovered that the mod_proxy module incorrectly handled\ncertain requests. A remote attacker could use this issue to cause the\nserver to stop responding, leading to a denial of service. This issue only\naffected Ubuntu 14.04 LTS. (CVE-2014-0117)\n\nGiancarlo Pellegrino and Davide Balzarotti discovered that the mod_deflate\nmodule incorrectly handled body decompression. A remote attacker could use\nthis issue to cause resource consumption, leading to a denial of service.\n(CVE-2014-0118)\n\nMarek Kroemeke and others discovered that the mod_status module incorrectly\nhandled certain requests. A remote attacker could use this issue to cause\nthe server to stop responding, leading to a denial of service, or possibly\nexecute arbitrary code. (CVE-2014-0226)\n\nRainer Jung discovered that the mod_cgid module incorrectly handled certain\nscripts. A remote attacker could use this issue to cause the server to stop\nresponding, leading to a denial of service. (CVE-2014-0231)\n","status":"published","published":"2014-07-23T20:04:57Z","modified":"2026-04-22T08:58:04.784492Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}