CVE-2003-0016: Apache HTTP Server

High severity, CVSS 7.5. EPSS: 17.8% chance of exploitation in the next 30 days.

Apache before 2.0.44, when running on unpatched Windows 9x and Me operating systems, allows remote attackers to cause a denial of service or execute arbitrary code via an HTTP request containing MS-DOS device names.

Affected products

• Apache HTTP Server: version 2.0.36 only; version 2.0.37 only; version 2.0.38 only; version 2.0.39 only; version 2.0.40 only; version 2.0.41 only; …

Published 2003-02-07. Last modified 2026-06-16.