CVE-2006-4154: Apache HTTP Server

Medium severity, CVSS 6.8. EPSS: 16.4% chance of exploitation in the next 30 days.

Format string vulnerability in the mod_tcl module 1.0 for Apache 2.x allows context-dependent attackers to execute arbitrary code via format string specifiers that are not properly handled in a set_var function call in (1) tcl_cmds.c and (2) tcl_core.c.

Affected products

• Apache HTTP Server: version 2.0 only; version 2.0.9 only; version 2.0.28 only; version 2.0.32 only; version 2.0.34 only; version 2.0.35 only; …

Published 2006-10-16. Last modified 2026-06-16.