CVE-2011-3639: Apache mod_proxy reverse proxy bypass via malformed URI

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityThe flaw allows a proxy bypass to intranet servers but has only partial integrity impact, requires specific proxy configuration, and has no confirmed exploitation in KEV.

What it is

Apache HTTP Server mod_proxy, with the Revision 1179239 patch applied, mishandles RewriteRule and ProxyPassMatch pattern matching for reverse proxy configuration. A remote attacker can send a request with the HTTP/0.9 protocol and a malformed URI beginning with an @ character to reach intranet servers behind the proxy. This is an incomplete fix for CVE-2011-3368, so systems patched for that earlier issue remain exposed.

Impact

An attacker can bypass the reverse proxy's intended access restrictions and route requests to internal or intranet servers that should not be reachable from outside. The CVSS vector shows no confidentiality or availability impact, only partial integrity impact.

Attack surface

Reachable over the network via HTTP requests to the proxy; no authentication is required. The attack requires the proxy to be configured with RewriteRule or ProxyPassMatch and the Revision 1179239 patch to be in place, and the attacker must craft a malformed URI using HTTP/0.9.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.506, ~98.9th percentile), but the references carry no exploit tags, so active exploitation is not confirmed by this record.

What to do

• Upgrade Apache HTTP Server to a version that includes the complete fix for CVE-2011-3368 and CVE-2011-3639; 2.2.18 or later for the 2.2.x branch.
• Apply vendor errata (Red Hat RHSA-2012-0128, Debian DSA-2405) where distribution packages are used.
• Review RewriteRule and ProxyPassMatch reverse proxy configurations for patterns that can be bypassed by malformed URIs.
• Restrict proxy access to internal resources at the network layer so a proxy bypass cannot reach intranet servers.
• Reject or normalize malformed request URIs, including HTTP/0.9 requests and leading @ characters, at the edge.

Detection

• Inspect proxy and web server logs for HTTP/0.9 requests or request lines containing an @ character in the URI.
• Alert on requests to the reverse proxy whose URI does not match expected RewriteRule or ProxyPassMatch patterns.
• Monitor outbound connections from the proxy host to intranet addresses that are not part of normal proxy traffic.
• Correlate proxy access logs with backend server logs to find requests reaching internal hosts without a matching external request.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.