CVE-2004-0751: Apache mod_ssl reverse proxy char_buffer_read segmentation fault DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityCVSS 2.0 rates this 5.0 (MEDIUM) with availability-only impact, but EPSS is high and the flaw is remotely triggerable without authentication in reverse proxy SSL configurations.

What it is

The char_buffer_read function in Apache 2.x mod_ssl mishandles data when the server is configured to reverse proxy to an SSL backend, causing a segmentation fault. A remote attacker can crash the httpd process, disrupting service on affected reverse proxy deployments.

Impact

An attacker gains denial of service: the Apache worker or process crashes, interrupting availability for proxied SSL traffic. No confidentiality or integrity impact is indicated by the CVSS vector.

Attack surface

Reachable over the network (AV:N) with no authentication (Au:N) and low complexity (AC:L), but only when mod_ssl is configured for reverse proxying to an SSL server. No user interaction is required.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, though EPSS is high at 0.723 (99.4th percentile). The vendor Bugzilla entry is tagged Patch, indicating a fix exists.

What to do

• Apply the Apache httpd fix referenced in the vendor Bugzilla issue 30134 or the relevant distribution errata (Red Hat RHSA-2004-463, Gentoo GLSA-200409-21, Novell, Mandrake, Trustix).
• If patching is delayed, avoid or disable mod_ssl reverse proxying to SSL backends until the fix is applied.
• Restrict network access to the reverse proxy to trusted client ranges where feasible.
• Monitor httpd for repeated crashes and restart automatically to limit outage duration.

Detection

• Watch httpd error and system logs for segmentation faults or child process crashes tied to mod_ssl reverse proxy requests.
• Monitor for abnormal httpd process restarts or core dumps on hosts running Apache 2.x with mod_ssl reverse proxying.
• Alert on repeated connection failures or 502/503 responses from the reverse proxy that coincide with process crashes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.