CVE-2019-0211
Apache HTTP Server Privilege Escalation Vulnerability
Published Apr 8, 2019 · updated Jun 16, 2026 · apache http server
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
Timeline
Detection, updates, and resolution for this record.
Apr 8, 2019 · Catalog
Detected
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe apache/http serverversion unspecified
- cpe canonical/ubuntu linux14.04
- cpe canonical/ubuntu linux16.04
- cpe canonical/ubuntu linux18.04
- cpe canonical/ubuntu linux18.10
- cpe debian/debian linux9.0
- cpe fedoraproject/fedora28
- cpe fedoraproject/fedora29
- cpe fedoraproject/fedora30
- cpe netapp/oncommand unified managerversion unspecified
- cpe opensuse/leap15.0
- cpe redhat/jboss core services1.0
- vendor Apache HTTP Serverversion unspecified
Sources
- CISA KEVCVE-2019-0211
Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.
cisa.gov - CVE.orgCVE-2019-0211
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-0211
30-day exploitation probability 65.0%
first.org - Exploit Database46676
Public archive entry. The exploit body is not stored here.
exploit-db.com - NIST NVDCVE-2019-0211
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html
Packet Storm link already published on the finding.
packetstormsecurity.com