CVE-2004-0493: Apache HTTP Server

Medium severity, CVSS 6.4. EPSS: 84.8% chance of exploitation in the next 30 days.

The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.

Affected products

• Apache HTTP Server: version 2.0.47 only; version 2.0.48 only; version 2.0.49 only
• Avaya Converged Communications Server: version 2.0 only
• Avaya s8300: version r2.0.0 only
• Avaya s8500: version r2.0.0 only
• Avaya s8700: version r2.0.0 only
• Gentoo Linux: version 1.4 only
• IBM HTTP Server: version 2.0.42 only; version 2.0.42.1 only; version 2.0.42.2 only; version 2.0.47 only; version 2.0.47.1 only
• Trustix Secure Linux: version 1.5 only; version 2.0 only; version 2.1 only

Published 2004-08-06. Last modified 2026-06-16.