Vulnerability in Apache HTTP Server
CVE-2012-3526
The reverse proxy add forward module (mod_rpaf) 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service (server or application crash) via multiple X-Forwarded-For headers in a request.
EPSS: 0.070 (93.4th percentile) — read the EPSS interpretation.
Affected products
- Apache Http_server
- Thomas_eibner Mod_rpaf — versions 0.5, 0.6
- N/a — versions n/a
Public proof-of-concept exploits
References
- secalert@redhat.com (mailing-list, x_refsource_MLIST)
- secalert@redhat.com (x_refsource_MISC)
- secalert@redhat.com (x_refsource_MISC)
- secalert@redhat.com (mailing-list, x_refsource_MLIST)
- secalert@redhat.com (vdb-entry, x_refsource_BID)
- secalert@redhat.com (vdb-entry, x_refsource_XF)
- secalert@redhat.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN)
Frequently asked questions
- What is CVE-2012-3526?
- CVE-2012-3526 is a vulnerability in Apache HTTP Server. Published 2012-09-05.
- Is CVE-2012-3526 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.