CVE-2015-0253

The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote…

published July 20, 2015

CVSS
—
EPSS
13%
Percentile
96.3
In the wild
Unconfirmed
What it is

The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.12975 · 96.3th percentile
Published
2015-07-20T23:00Z
EPSS history
Timeline
  • 20 JUL 23:00Z
    The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote…
    cvelistv5