{"id":"CVE-2019-0190","aliases":["ALPINE-CVE-2019-0190","BELL-CVE-2019-0190","DEBIAN-CVE-2019-0190","EUVD-2019-0994","GHSA-m3q7-x278-m229"],"status":"published","title":"A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a...","description":"A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.59942,"percentile":0.9914,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-01-30T22:00:00Z","modified":"2026-10-24T10:30:27Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"apache2","fixed_in":["2.4.38-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"apache2","fixed_in":["2.4.38-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache2","fixed_in":["2.4.38-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache2","fixed_in":["2.4.38-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-1"}]}]}],"products":[{"vendor":"apache","product":"http_server"},{"vendor":"apache software foundation","product":"apache http server"},{"vendor":"oracle","product":"enterprise_manager_ops_center"},{"vendor":"oracle","product":"hospitality_guest_access"},{"vendor":"oracle","product":"instantis_enterprisetrack"},{"vendor":"oracle","product":"retail_xstore_point_of_service"}],"references":[{"url":"http://www.securityfocus.com/bid/106743","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201903-21","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190125-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0190"},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-m3q7-x278-m229"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-0190","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-0190","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-0190","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-0190","description":"A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.","status":"published","published":"2019-01-30T22:00:00Z","modified":"2024-09-16T23:41:59.848Z","updated_at":"2026-11-02T14:32:24.110857Z"}],"euvd":[{"id":"EUVD-2019-0994","description":"A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.","status":"published","published":"2019-01-30T22:00:00Z","modified":"2024-09-16T23:41:59Z","updated_at":"2026-11-03T00:54:47.592767Z"}],"ghsa":[{"id":"GHSA-m3q7-x278-m229","title":"A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a...","description":"A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.","status":"published","published":"2022-05-13T01:08:23Z","modified":"2023-02-01T05:03:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:50:02.204531Z"}],"nvd":[{"id":"CVE-2019-0190","description":"A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.","status":"published","published":"2019-01-30T22:29:00.497Z","modified":"2026-06-17T02:07:54.847Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:02.989216Z"}],"osv":[{"id":"ALPINE-CVE-2019-0190","description":"A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.","status":"published","published":"2019-01-30T22:29:00.497Z","modified":"2026-09-21T06:17:52.472941471Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2019-0190","title":"CVE-2019-0190 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:13.246023Z","modified":"2026-01-26T09:48:41.472757Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2019-0190","description":"A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.","status":"published","published":"2019-01-30T22:29:00.497Z","modified":"2026-10-24T10:30:27.792651055Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"DEBIAN-CVE-2019-0190","description":"A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.","status":"published","published":"2019-01-30T22:29:00.497Z","modified":"2026-09-21T07:00:03.825354847Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"}]}}