CVE-2015-0228: Apache HTTP Server

Medium severity, CVSS 5.0. EPSS: 16.5% chance of exploitation in the next 30 days.

The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.

Affected products

• Apache HTTP Server: up to and including 2.4.12
• Apple Mac OS X: version 10.10.4 only
• Apple Mac OS X Server: version 5.0.3 only
• Canonical Ubuntu Linux: version 10.04 only; version 12.04 only; version 14.04 only; version 14.10 only
• Opensuse Opensuse: version 13.2 only

Published 2015-03-08. Last modified 2026-06-17.