Read the docs
TI-2002-00818 Aliases CVE-2002-0843GHSA-v5cr-9693-q9cg

Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before…

Priority MEDIUM 52Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.

Why it matters now

EPSS 0.21421 97th percentileScored 2026-11-07
Fix Fixed Red Hat: 5 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 30

CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:1.3:*:*:*:*:*:*:*1.3VulnerableApache
cpe:2.3:a:apache:http_server:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableApache
cpe:2.3:a:apache:http_server:1.3.3:*:*:*:*:*:*:*1.3.3VulnerableApache
cpe:2.3:a:apache:http_server:1.3.4:*:*:*:*:*:*:*1.3.4VulnerableApache
cpe:2.3:a:apache:http_server:1.3.6:*:*:*:*:*:*:*1.3.6VulnerableApache
cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:*1.3.9VulnerableApache
cpe:2.3:a:apache:http_server:1.3.11:*:*:*:*:*:*:*1.3.11VulnerableApache
cpe:2.3:a:apache:http_server:1.3.12:*:*:*:*:*:*:*1.3.12VulnerableApache
cpe:2.3:a:apache:http_server:1.3.14:*:*:*:*:*:*:*1.3.14VulnerableApache
cpe:2.3:a:apache:http_server:1.3.17:*:*:*:*:*:*:*1.3.17VulnerableApache
  • cpe:2.3:a:apache:http_server:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.4:*:*:*:*:*:*:* Versions 1.3.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.6:*:*:*:*:*:*:* Versions 1.3.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:* Versions 1.3.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.11:*:*:*:*:*:*:* Versions 1.3.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.12:*:*:*:*:*:*:* Versions 1.3.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.14:*:*:*:*:*:*:* Versions 1.3.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.17:*:*:*:*:*:*:* Versions 1.3.17 Vulnerable ·Apache
Show 20 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:1.3.18:*:*:*:*:*:*:*1.3.18VulnerableApache
cpe:2.3:a:apache:http_server:1.3.19:*:*:*:*:*:*:*1.3.19VulnerableApache
cpe:2.3:a:apache:http_server:1.3.20:*:*:*:*:*:*:*1.3.20VulnerableApache
cpe:2.3:a:apache:http_server:1.3.22:*:*:*:*:*:*:*1.3.22VulnerableApache
cpe:2.3:a:apache:http_server:1.3.23:*:*:*:*:*:*:*1.3.23VulnerableApache
cpe:2.3:a:apache:http_server:1.3.24:*:*:*:*:*:*:*1.3.24VulnerableApache
cpe:2.3:a:apache:http_server:1.3.25:*:*:*:*:*:*:*1.3.25VulnerableApache
cpe:2.3:a:apache:http_server:1.3.26:*:*:*:*:*:*:*1.3.26VulnerableApache
cpe:2.3:a:oracle:application_server:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableOracle
cpe:2.3:a:oracle:application_server:1.0.2.1s:*:*:*:*:*:*:*1.0.2.1sVulnerableOracle
cpe:2.3:a:oracle:application_server:1.0.2.2:*:*:*:*:*:*:*1.0.2.2VulnerableOracle
cpe:2.3:a:oracle:application_server:9.0.2:*:*:*:*:*:*:*9.0.2VulnerableOracle
cpe:2.3:a:oracle:application_server:9.0.2:r2:*:*:*:*:*:*9.0.2 r2VulnerableOracle
cpe:2.3:a:oracle:application_server:9.0.2.1:*:*:*:*:*:*:*9.0.2.1VulnerableOracle
cpe:2.3:a:oracle:database_server:8.1.7:*:*:*:*:*:*:*8.1.7VulnerableOracle
cpe:2.3:a:oracle:database_server:9.2.2:*:*:*:*:*:*:*9.2.2VulnerableOracle
cpe:2.3:a:oracle:oracle8i:8.1.7:*:*:*:*:*:*:*8.1.7VulnerableOracle
cpe:2.3:a:oracle:oracle8i:8.1.7.0.0_enterprise:*:*:*:*:*:*:*8.1.7.0.0_enterpriseVulnerableOracle
cpe:2.3:a:oracle:oracle8i:8.1.7.1:*:*:*:*:*:*:*8.1.7.1VulnerableOracle
cpe:2.3:a:oracle:oracle8i:8.1.7.1.0_enterprise:*:*:*:*:*:*:*8.1.7.1.0_enterpriseVulnerableOracle
  • cpe:2.3:a:apache:http_server:1.3.18:*:*:*:*:*:*:* Versions 1.3.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.19:*:*:*:*:*:*:* Versions 1.3.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.20:*:*:*:*:*:*:* Versions 1.3.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.22:*:*:*:*:*:*:* Versions 1.3.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.23:*:*:*:*:*:*:* Versions 1.3.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.24:*:*:*:*:*:*:* Versions 1.3.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.25:*:*:*:*:*:*:* Versions 1.3.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:1.3.26:*:*:*:*:*:*:* Versions 1.3.26 Vulnerable ·Apache
  • cpe:2.3:a:oracle:application_server:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_server:1.0.2.1s:*:*:*:*:*:*:* Versions 1.0.2.1s Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_server:1.0.2.2:*:*:*:*:*:*:* Versions 1.0.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_server:9.0.2:*:*:*:*:*:*:* Versions 9.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_server:9.0.2:r2:*:*:*:*:*:* Versions 9.0.2 r2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_server:9.0.2.1:*:*:*:*:*:*:* Versions 9.0.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:database_server:8.1.7:*:*:*:*:*:*:* Versions 8.1.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:database_server:9.2.2:*:*:*:*:*:*:* Versions 9.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:oracle8i:8.1.7:*:*:*:*:*:*:* Versions 8.1.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:oracle8i:8.1.7.0.0_enterprise:*:*:*:*:*:*:* Versions 8.1.7.0.0_enterprise Vulnerable ·Oracle
  • cpe:2.3:a:oracle:oracle8i:8.1.7.1:*:*:*:*:*:*:* Versions 8.1.7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:oracle8i:8.1.7.1.0_enterprise:*:*:*:*:*:*:* Versions 8.1.7.1.0_enterprise Vulnerable ·Oracle

Remediation

Red Hat 5 advisories

  • RHSA-2003:106 Released 2003-04-22 · Red Hat rating Important
    : : : Updated apache and mod_ssl packages available
    • Red Hat Linux 7.1
  • RHSA-2002:251 Released 2003-01-09 · Red Hat rating Important
    apache security update
    • Red Hat Enterprise Linux AS (Advanced Server) version 2.1
    • Red Hat Linux Advanced Workstation 2.1
  • RHSA-2002:244 Released 2002-11-08 · Red Hat rating Important
    apache, mod_ssl, php security update for Stronghold
    • Red Hat Stronghold 4
Show 2 more Red Hat advisories
  • RHSA-2002:243 Released 2002-11-08 · Red Hat rating Important
    apache, mod_ssl, php security update for Stronghold
    • Red Hat Stronghold 3
  • RHSA-2002:248 Released 2002-11-07 · Red Hat rating Important
    apache, mod_ssl, php security update for Stronghold
    • Stronghold 4 for Red Hat Enterprise Linux

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 Fixed RHSA-2002:251
Red Hat Linux 6.2Fixed RHSA-2002:222
Red Hat Linux 7.0Fixed RHSA-2002:222
Red Hat Linux 7.1Fixed RHSA-2002:222
Red Hat Linux 7.2Fixed RHSA-2002:222
Red Hat Linux 7.3Fixed RHSA-2002:222
Red Hat Linux 8.0Fixed RHSA-2002:222
Red Hat Linux Advanced Workstation 2.1Fixed RHSA-2002:251
Red Hat Stronghold 3Fixed RHSA-2002:243
Red Hat Stronghold 4Fixed RHSA-2002:244
Stronghold 4 for Red Hat Enterprise LinuxFixed RHSA-2002:248

Timeline

  1. 2026-10-02 Threatist record created from CVE-2002-0843
  2. 2026-10-03 Alias added: GHSA-v5cr-9693-q9cg

References

Advisory 9

Other 13

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences