CVE-2002-0082: Apache-SSL

High severity, CVSS 7.5. EPSS: 29.7% chance of exploitation in the next 30 days.

The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.

Affected products

• Apache-SSL Apache-SSL: version 1.40 only; version 1.41 only; version 1.42 only; version 1.44 only; version 1.45 only; version 1.46 only
• Mod SSL Mod SSL: version 2.7.1 only; version 2.8 only; version 2.8.1 only; version 2.8.2 only; version 2.8.3 only; version 2.8.4 only; …

Published 2002-03-15. Last modified 2026-06-16.