CVE-2003-0993: Apache HTTP Server

High severity, CVSS 7.5. EPSS: 10.8% chance of exploitation in the next 30 days.

mod_access in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions.

Affected products

• Apache HTTP Server: version 1.3 only; version 1.3.1 only; version 1.3.3 only; version 1.3.4 only; version 1.3.6 only; version 1.3.7 only; …

Published 2004-03-29. Last modified 2026-06-16.