CVE-2019-10097: Apache HTTP Server

High severity, CVSS 7.2. EPSS: 52.9% chance of exploitation in the next 30 days.

In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.

Affected products

• Apache HTTP Server: version 2.4.33 only; version 2.4.34 only; version 2.4.35 only; version 2.4.37 only; version 2.4.38 only
• Oracle Communications Element Manager: version 8.0.0 only; version 8.1.0 only; version 8.1.1 only; version 8.2.0 only
• Oracle Communications Session Report Manager: version 8.1.1 only; version 8.2.0 only; version 8.2.1 only
• Oracle Communications Session Route Manager: version 8.1.1 only; version 8.2.0 only; version 8.2.1 only
• Oracle Enterprise Manager Ops Center: version 12.3.3 only; version 12.4.0 only
• Oracle HTTP Server: version 12.2.1.4.0 only
• Oracle Instantis Enterprisetrack: from 17.1, up to and including 17.3
• Oracle Retail Xstore Point Of Service: version 7.1 only

Published 2019-09-26. Last modified 2026-06-17.