CVE-2010-0434: Apache HTTP Server

Medium severity, CVSS 4.3. EPSS: 18.4% chance of exploitation in the next 30 days.

The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.

Affected products

• Apache HTTP Server: from 2.0.35, before 2.0.64 (fixed in 2.0.64); from 2.2.0, before 2.2.15 (fixed in 2.2.15)
• Debian Debian Linux: version 5.0 only; version 6.0 only
• Fedoraproject Fedora: version 11 only; version 13 only

Published 2010-03-05. Last modified 2026-06-16.