CVE-2004-0492: Apache HTTP Server

High severity, CVSS 10.0. EPSS: 33.6% chance of exploitation in the next 30 days.

Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.

Affected products

• Apache HTTP Server: version 1.3.26 only; version 1.3.27 only; version 1.3.28 only; version 1.3.29 only; version 1.3.31 only
• HP Virtualvault: version 11.0.4 only
• HP Vvos: version 11.04 only
• HP Webproxy: version 2.0 only; version 2.1 only
• IBM HTTP Server: version 1.3.26 only; version 1.3.26.1 only; version 1.3.26.2 only; version 1.3.28 only
• OpenBSD OpenBSD: any version; version 3.4 only; version 3.5 only
• Sgi Propack: version 2.4 only

Published 2004-08-06. Last modified 2026-06-16.