CVE-2016-5387: Apache HTTP Server httpoxy HTTP_PROXY header proxy redirection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityHigh CVSS severity and very high EPSS percentile, but no KEV listing or documented exploitation and the record itself states this is a mitigation identifier.

What it is

Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and passes untrusted client data into the HTTP_PROXY environment variable, the httpoxy issue. Applications running under the server can have their outbound HTTP traffic redirected to an attacker-controlled proxy. The record notes this is a mitigation identifier rather than a CVE for a vulnerability in Apache itself.

Impact

An attacker can redirect an application's outbound HTTP requests through an arbitrary proxy, potentially intercepting or altering that traffic. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reachable remotely over the network by sending a crafted Proxy header in an HTTP request; no authentication or user interaction is required per the CVSS vector. The flaw manifests in applications that trust the HTTP_PROXY environment variable set from that header.

Exploitation

Not listed in CISA KEV and no ransomware usage documented. EPSS 30-day probability is 0.55724 (99th percentile), and references are advisories and patches rather than exploit code.

What to do

• Apply vendor patches for Apache HTTP Server and the listed distributions and products (Red Hat, Debian, Ubuntu, SUSE, Oracle, HPE).
• Configure the web server or application runtime to unset or ignore the HTTP_PROXY environment variable for request handling.
• Review application code and libraries that read HTTP_PROXY or proxy settings from the environment.
• Restrict outbound network egress from application servers to approved destinations.
• Track vendor advisories for the affected products until all instances are patched.

Detection

• Monitor web server and application logs for requests containing a Proxy header.
• Alert on unexpected outbound HTTP connections from application servers to unfamiliar proxy addresses.
• Audit environment variables of web application processes for HTTP_PROXY values.
• Review egress proxy and firewall logs for anomalous proxy destinations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.