CVE-2012-3502: Apache HTTP Server

Medium severity, CVSS 4.3. EPSS: 9.6% chance of exploitation in the next 30 days.

The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.

Affected products

• Apache HTTP Server: version 2.4.0 only; version 2.4.1 only; version 2.4.2 only

Published 2012-08-22. Last modified 2026-06-16.