CVE-2018-17199: Apache HTTP Server

High severity, CVSS 7.5. EPSS: 20.2% chance of exploitation in the next 30 days.

In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.

Affected products

• Apache HTTP Server: from 2.4.0, up to and including 2.4.37
• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only; version 18.10 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• Netapp Santricity Cloud Connector: affected versions not specified
• Netapp Storage Automation Store: affected versions not specified
• Oracle Enterprise Manager Ops Center: version 12.3.3 only

Published 2019-01-30. Last modified 2026-06-17.