← Vulnerability Intelligence

CVE-2019-0211

High 7.8 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
Apache HTTP Server Privilege Escalation Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

Metrics

CVSS 3.1
7.8 (HIGH) Score source: NVD CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
65% (percentile: 99) as of 2 November 2026
CWE
CWE-416

Affected products

apache: http server; fedoraproject: fedora; canonical: ubuntu linux; debian: debian linux; opensuse: leap; netapp: oncommand unified manager; redhat: jboss core services; redhat: openshift container platform; redhat: openshift container platform for power; redhat: software collections; redhat: enterprise linux; redhat: enterprise linux eus; redhat: enterprise linux for arm 64; redhat: enterprise linux for arm 64 eus; redhat: enterprise linux for ibm z systems

References