Read the docs
TI-2019-07407 Aliases CVE-2019-10082GHSA-28c2-r3qq-82vj

Use after free in Apache HTTP Server

Priority MEDIUM 56CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Partial Red Hat: 4 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.

Why it matters now

EPSS 0.16549 97th percentileScored 2026-11-07
Fix Partial Red Hat: 3 advisoriesRed Hat: 4 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache HTTP Server2.4.18 to 2.4.39—No fix listedCNA
  • Apache HTTP Server Vendor— Affected 2.4.18 to 2.4.39 Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*2.4.18 – 2.4.39VulnerableApache
cpe:2.3:a:oracle:communications_element_manager:8.0.0:*:*:*:*:*:*:*8.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_element_manager:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*8.1.1VulnerableOracle
cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*8.2.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*12.3.3VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*12.4.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*12.4.0.0VulnerableOracle
cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
  • cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions 2.4.18 – 2.4.39 Vulnerable ·Apache
  • cpe:2.3:a:oracle:communications_element_manager:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_element_manager:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:* Versions 8.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:* Versions 8.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* Versions 12.3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* Versions 12.4.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:*17.1 – 17.3VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*7.1VulnerableOracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:* Versions 17.1 – 17.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle

Remediation

Red Hat 3 advisories

  • RHSA-2020:4751 Released 2020-11-04 · Red Hat rating Moderate
    httpd:2.4 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) httpd-2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64::httpd:2.4, httpd-2.4.37-30.module+el8.3.0+7001+0766b9e7.ppc64le::httpd:2.4, httpd-2.4.37-30.module+el8.3.0+7001+0766b9e7.s390x::httpd:2.4 +38
  • RHSA-2020:1337 Released 2020-04-06 · Red Hat rating Moderate
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 security update
    • Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-apr-1.6.3-86.jbcs.el6, jbcs-httpd24-apr-devel-1.6.3-86.jbcs.el6, jbcs-httpd24-brotli-1.0.6-21.jbcs.el6 +17
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-1.6.3-86.jbcs.el7, jbcs-httpd24-apr-devel-1.6.3-86.jbcs.el7, jbcs-httpd24-brotli-1.0.6-21.jbcs.el7 +17
  • RHSA-2020:1336 Released 2020-04-06 · Red Hat rating Moderate
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 security update
    • JBoss Core Services Apache HTTP Server 2.4.37 SP2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Web Server 2AffectedNo fix planned: Out of support scope
Red Hat JBoss Web Server 3AffectedNo fix planned: Out of support scope
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
JBoss Core Services Apache HTTP Server 2.4.37 SP2Fixed RHSA-2020:1336
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4751
Red Hat JBoss Core Services on RHEL 6 ServerFixed RHSA-2020:1337
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2020:1337
Not affected: 3 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10082
  2. 2026-10-03 Alias added: GHSA-28c2-r3qq-82vj

References

Patch 4

Advisory 1

Other 11

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences