Vulnerability record · CVE-2006-3918 · published 28 July 2006
CVE-2006-3918: Apache and IBM HTTP Server Expect header XSS in error messages
Apache · Http Server
Apache HTTP Server and IBM HTTP Server fail to sanitize the Expect request header before reflecting it in error messages. This allows cross-site scripting style attacks when a client component, such as a Flash SWF file, can send arbitrary headers. The flaw affects multiple older server branches and was patched by the vendors.
Description
http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.
AV:N/AC:M/Au:N/C:N/I:P/A:N
Automated analysis
medium priorityCVSS 2.0 scores this as medium with partial integrity impact, but the very high EPSS and public exploit references raise concern for exposed legacy servers.
What it is
Apache HTTP Server and IBM HTTP Server fail to sanitize the Expect request header before reflecting it in error messages. This allows cross-site scripting style attacks when a client component, such as a Flash SWF file, can send arbitrary headers. The flaw affects multiple older server branches and was patched by the vendors.
Impact
An attacker can inject script content into a server error response, potentially executing code in the context of a victim's browser session. The CVSS vector shows partial integrity impact with no confidentiality or availability impact.
Attack surface
The flaw is reachable over the network via HTTP requests containing a crafted Expect header. No authentication is required, but exploitation depends on a client component capable of sending arbitrary headers, as demonstrated with a Flash SWF file.
Exploitation
CISA KEV does not list this CVE, but EPSS is very high at 0.95103 (99.86th percentile). Two Bugtraq references are tagged as Exploit, indicating public exploit material exists.
What to do
- Upgrade Apache HTTP Server to 1.3.35, 2.0.58, or 2.2.2 or later, and IBM HTTP Server to 6.0.2.13 or 6.1.0.1 or later.
- Apply vendor errata such as RHSA-2006-0618 and RHSA-2006-0692 for Red Hat Enterprise Linux.
- Sanitize or encode the Expect header before reflecting it in any error response.
- Restrict or disable client components such as Flash that can send arbitrary HTTP headers if not required.
- Review reverse proxy and load balancer configurations for header reflection behavior.
Detection
- Search web server error logs for requests containing unusual or script-like Expect header values.
- Monitor for HTTP responses that reflect Expect header content in error pages.
- Use network detection to flag Flash or other client components sending custom Expect headers to web servers.
- Audit web server versions against the fixed releases listed in vendor advisories.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-3918 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-3918), CISA KEV, FIRST EPSS (scores of 2026-09-25). This page is refreshed as NVD updates the record.
