CVE-2002-0839: Apache HTTP Server

High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days.

The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.

Affected products

• Apache HTTP Server: from 1.3.0, before 1.3.27 (fixed in 1.3.27)
• Debian Debian Linux: version 2.2 only; version 3.0 only

Published 2002-10-11. Last modified 2026-06-16.