CVE-2004-0493 Denial of service in n/a

What is CVE-2004-0493?

CVE-2004-0493 is a medium-severity denial of service vulnerability in Apache Http Server, published on 30 Jun 2004. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.

Which versions are affected by CVE-2004-0493?

It affects 8 products.

Products include Apache Http Server, Avaya Converged Communications Server, Avaya S8300, Avaya S8500, Avaya S8700, Gentoo Linux and 2 more.

How do I fix CVE-2004-0493?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2004-0493 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2004-0493 exists.

Public exploit code: 2 Exploit-DB entries.

Other vulnerabilities in Apache Http Server

• CVE-2021-42013 Apache HTTP Server Path Traversal Exploited Critical 9.8
• CVE-2024-38475 Apache HTTP Server Improper Escaping of Output Exploited Critical 9.1
• CVE-2021-40438 Apache HTTP Server-Side Request Forgery (SSRF) Exploited Critical 9.0
• CVE-2019-0211 Apache HTTP Server Privilege Escalation Exploited High 7.8
• CVE-2021-41773 Apache HTTP Server Path Traversal Exploited High 7.5

All Apache Http Server vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2004-0493, GHSA-jc6w-8vm4-hvp8.