CVE-2020-1927: Apache HTTP Server

Medium severity, CVSS 6.1. EPSS: 56.7% chance of exploitation in the next 30 days.

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.

Affected products

• Apache HTTP Server: from 2.4.0, up to and including 2.4.41
• Broadcom Brocade Fabric Operating System: affected versions not specified
• Canonical Ubuntu Linux: version 16.04 only; version 18.04 only; version 20.04 only
• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 31 only; version 32 only
• Netapp Oncommand Unified Manager Core Package: affected versions not specified
• Opensuse Leap: version 15.1 only
• Oracle Communications Element Manager: version 8.1.1 only; version 8.2.0 only; version 8.2.1 only
• Oracle Communications Session Report Manager: version 8.1.1 only; version 8.2.0 only; version 8.2.1 only
• Oracle Communications Session Route Manager: version 8.1.1 only; version 8.2.0 only; version 8.2.1 only
• Oracle Enterprise Manager Ops Center: version 12.4.0.0 only
• Oracle Instantis Enterprisetrack: from 17.1, up to and including 17.3
• Oracle SD-WAN Aware: version 8.2 only
• Oracle ZFS Storage Appliance Kit: version 8.8 only

Published 2020-04-02. Last modified 2026-06-17.