CVE-2001-0925: Apache HTTP Server

Medium severity, CVSS 5.0. EPSS: 75.2% chance of exploitation in the next 30 days.

The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.

Affected products

• Apache HTTP Server: version 1.3.11 only; version 1.3.12 only; version 1.3.14 only; version 1.3.17 only
• Debian Debian Linux: version 2.2 only

Published 2001-03-12. Last modified 2026-06-16.