{"id":"CVE-2014-3583","aliases":["BELL-CVE-2014-3583","DEBIAN-CVE-2014-3583","EUVD-2014-3559","GHSA-jh98-gwvf-4vf3","RHSA-2015:1855","UBUNTU-CVE-2014-3583","USN-2523-1","openSUSE-SU-2024:10268-1"],"status":"published","title":"The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP...","description":"The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.10783,"percentile":0.95865,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2014-12-15T00:00:00Z","modified":"2026-10-23T15:47:37Z","fixes":[{"ecosystem":"Debian:12","package":"apache2","fixed_in":["2.4.10-8"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache2","fixed_in":["2.4.10-8"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache2","fixed_in":["2.4.10-8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_common:6::el6","package":"mod_proxy_fcgi","fixed_in":["0:2.4.10-5.20150415gitd45a11f.el6cp"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_common:6::el6","package":"mod_proxy_fcgi-debuginfo","fixed_in":["0:2.4.10-5.20150415gitd45a11f.el6cp"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-8"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-8"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_common:6::el6","package":"mod_proxy_fcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.10-5.20150415gitd45a11f.el6cp"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_common:6::el6","package":"mod_proxy_fcgi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.10-5.20150415gitd45a11f.el6cp"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu4.4"}]}],"versions":["2.4.6-2ubuntu2","2.4.6-2ubuntu3","2.4.6-2ubuntu4","2.4.7-1ubuntu1","2.4.7-1ubuntu2","2.4.7-1ubuntu3","2.4.7-1ubuntu4","2.4.7-1ubuntu4.1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-4.1"}]}],"bundled":48}],"products":[{"vendor":"apache","product":"http_server"},{"vendor":"apple","product":"mac_os_x"},{"vendor":"apple","product":"os_x_server"},{"vendor":"canonical","product":"ubuntu_linux"}],"references":[{"url":"http://httpd.apache.org/security/vulnerabilities_24.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1163555","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://www.ubuntu.com/usn/USN-2523-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1638818","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1855.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/71657","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://support.apple.com/kb/HT205031","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1858","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://support.apple.com/HT205219","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201701-36","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3583","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-jh98-gwvf-4vf3"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2014-3583","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3583","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1855","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1855.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3583","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3583","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2014-3583","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2523-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-5704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3581","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-8109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-0228","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4979","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3583","description":"The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.","status":"published","published":"2014-12-15T17:27:00Z","modified":"2024-08-06T10:50:17.923Z","updated_at":"2026-11-02T14:33:44.569327Z"}],"euvd":[{"id":"EUVD-2014-3559","description":"The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.","status":"published","published":"2014-12-15T17:27:00Z","modified":"2024-08-06T10:50:17Z","updated_at":"2026-11-03T01:57:10.446744Z"}],"ghsa":[{"id":"GHSA-jh98-gwvf-4vf3","title":"The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP...","description":"The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.","status":"published","published":"2022-05-13T01:09:46Z","modified":"2025-04-12T12:44:09Z","cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:20.346559Z"}],"nvd":[{"id":"CVE-2014-3583","description":"The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.","status":"published","published":"2014-12-15T18:59:02.19Z","modified":"2026-06-17T00:08:33.82Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:57.680258Z"}],"osv":[{"id":"BELL-CVE-2014-3583","title":"CVE-2014-3583 does not affect BellSoft software","status":"withdrawn","published":"2014-12-15T18:59:00Z","modified":"2026-01-28T07:20:24.124069Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2014-3583","description":"The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.","status":"published","published":"2014-12-15T18:59:02Z","modified":"2026-04-10T03:43:48.11353Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3583","description":"The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.","status":"published","published":"2014-12-15T18:59:02.19Z","modified":"2026-10-23T15:47:37.700607893Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"openSUSE-SU-2024:10268-1","title":"apache2-2.4.23-4.1 on GA media","description":"These are all security issues fixed in the apache2-2.4.23-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:25:01.364403Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2015:1855","title":"Red Hat Security Advisory: mod_proxy_fcgi security update","status":"published","published":"2024-09-13T09:23:47Z","modified":"2026-08-05T10:03:20Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"UBUNTU-CVE-2014-3583","description":"The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.","status":"withdrawn","published":"2014-12-15T00:00:00Z","modified":"2026-02-04T02:53:08.042399Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2523-1","title":"apache2 vulnerabilities","description":"Martin Holst Swende discovered that the mod_headers module allowed HTTP\ntrailers to replace HTTP headers during request processing. A remote\nattacker could possibly use this issue to bypass RequestHeaders directives.\n(CVE-2013-5704)\n\nMark Montague discovered that the mod_cache module incorrectly handled\nempty HTTP Content-Type headers. A remote attacker could use this issue to\ncause the server to stop responding, leading to a denial of service. This\nissue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2014-3581)\n\nTeguh P. Alko discovered that the mod_proxy_fcgi module incorrectly\nhandled long response headers. A remote attacker could use this issue to\ncause the server to stop responding, leading to a denial of service. This\nissue only affected Ubuntu 14.10. (CVE-2014-3583)\n\nIt was discovered that the mod_lua module incorrectly handled different\narguments within different contexts. A remote attacker could possibly use\nthis issue to bypass intended access restrictions. This issue only affected\nUbuntu 14.10. (CVE-2014-8109)\n\nGuido Vranken discovered that the mod_lua module incorrectly handled a\nspecially crafted websocket PING in certain circumstances. A remote\nattacker could possibly use this issue to cause the server to stop\nresponding, leading to a denial of service. This issue only affected\nUbuntu 14.10. (CVE-2015-0228)\n","status":"published","published":"2015-03-10T14:49:16Z","modified":"2026-04-22T09:09:04.842045Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}