CVE-2014-0226: Apache HTTP Server mod_status race condition heap overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote, unauthenticated, with public exploit code and very high EPSS, though exploitation is timing-dependent and the CVSS base score is only 6.8.

What it is

A race condition in the mod_status module of Apache HTTP Server before 2.4.10 causes improper scoreboard handling in status_handler and lua_ap_scoreboard_worker, leading to a heap-based buffer overflow. It matters because a remote attacker can crash the server and may also read sensitive credential data or run arbitrary code.

Impact

An attacker can cause a denial of service by crashing the server, and possibly obtain sensitive credential information or execute arbitrary code in the server process.

Attack surface

Reachable remotely over the network via a crafted HTTP request that triggers the status handler; the CVSS vector AV:N/AC:M/Au:N indicates no authentication is required, though the race condition makes exploitation timing-dependent. The mod_status endpoint must be enabled and reachable for the vulnerable code path to be hit.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.857 probability, 99.7th percentile) and references include an Exploit tag and an Exploit-DB entry, indicating public exploit code exists.

What to do

• Upgrade Apache HTTP Server to 2.4.10 or later, or apply the vendor patches referenced in the Apache security advisory.
• If mod_status is not needed, disable it; otherwise restrict access to the /server-status endpoint to trusted management networks only.
• Apply distribution vendor updates (Debian, Red Hat, Oracle, Gentoo, Mageia) for affected packages.
• Monitor for and rate-limit repeated requests to the status handler from untrusted sources.

Detection

• Inspect web server logs for unusual or high-frequency requests to mod_status endpoints such as /server-status.
• Watch for Apache child process crashes or restarts correlated with status handler requests.
• Use IDS/IPS signatures for known exploit traffic targeting mod_status scoreboard handling.
• Alert on unexpected outbound connections or credential access from the web server process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.