CVE-2000-0505: Apache 1.3.x on Windows directory listing via slash-heavy URL

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityInformation disclosure only, no code execution, but public exploit information and a high EPSS percentile raise concern for any remaining legacy Windows Apache 1.3.x hosts.

What it is

Apache HTTP Server 1.3.x on Windows platforms fails to properly handle URLs containing a large number of '/' characters, allowing remote attackers to list directory contents. This is an information disclosure flaw in an end-of-life product line, so exposure depends on whether such legacy servers remain in service.

Impact

An unauthenticated attacker can enumerate directory contents that should not be browsable, exposing file and directory names useful for further targeting. No file modification or code execution is described.

Attack surface

Reachable over the network via a crafted HTTP request containing many '/' characters; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector.

Exploitation

Not listed in CISA KEV and no ransomware usage documented; EPSS is 0.46653 (98.8th percentile), and a reference is tagged Exploit, indicating public exploit information exists.

What to do

• Upgrade to a supported Apache HTTP Server release; 1.3.x is long end-of-life and no longer receives fixes.
• If legacy 1.3.x must remain, disable directory listing (Options -Indexes) and restrict browsing to intended content.
• Place affected servers behind a reverse proxy or WAF rule that rejects request paths with excessive consecutive or repeated '/' characters.
• Remove or restrict access to legacy Windows Apache hosts that cannot be patched, and audit them for exposed directories.

Detection

• Search web access logs for request URIs containing unusually long runs or high counts of '/' characters.
• Alert on HTTP responses returning directory index pages (e.g., 200 with 'Index of' body) from paths not intended to be listable.
• Monitor for scanning patterns that probe many paths with slash-heavy URLs from a single source.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.