Loading vulnerability…
Stack Buffer Overflow and NULL-Pointer Dereference in Apache HTTP Server mod_remoteip
CVE-2019-10097 affects PROXY-protocol header parsing in the mod_remoteip module of Apache HTTP Server versions 2.4.32 through 2.4.39. When the module is configured to use a trusted intermediary proxy with the PROXY protocol, a specially crafted header from that proxy can trigger a stack buffer overflow or NULL-pointer dereference, causing memory corruption or a process crash. Only a trusted proxy can trigger the vulnerability; untrusted HTTP clients cannot exploit it directly.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash affected Apache HTTP Server processes and disrupt service availability. The stack buffer overflow also introduces memory-corruption risks, but specific outcomes beyond crashes, including code execution or data compromise, are not established.
If you can’t patch tonight, do this now.
Where operationally feasible, disable PROXY-protocol processing or the unneeded mod_remoteip module until patched. Restrict access to PROXY-protocol listeners to strictly trusted, access-controlled intermediary proxies, and protect those proxies against compromise. Access restrictions do not prevent exploitation by a compromised trusted proxy.
Patch, then assume compromise.
Upgrade to a supported Apache HTTP Server release containing the fix introduced in version 2.4.41, or install the applicable vendor-backported security update. Debian buster addressed the vulnerability in apache2 version 2.4.38-3+deb10u1; Debian stretch is unaffected. Red Hat fixes are available through RHSA-2019:4126 for Software Collections, RHSA-2020:1336 and RHSA-2020:1337 for JBoss Core Services, and RHSA-2020:4751 for RHEL 8. Restart affected server processes after updating.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.