CVE-2006-3747: Apache HTTP Server

High severity, CVSS 7.6. EPSS: 96.6% chance of exploitation in the next 30 days.

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.

Affected products

• Apache HTTP Server: from 1.3.28, before 1.3.37 (fixed in 1.3.37); from 2.0.46, before 2.0.59 (fixed in 2.0.59); from 2.2.0, before 2.2.3 (fixed in 2.2.3)
• Canonical Ubuntu Linux: version 5.04 only; version 5.10 only; version 6.06 only
• Debian Debian Linux: version 3.1 only

Published 2006-07-28. Last modified 2026-06-16.