CVE-2019-0211: Apache HTTP Server scoreboard use-after-free local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with public exploit code and a high EPSS score, and successful exploitation yields root, though it requires an existing low-privileged execution context.

What it is

Apache HTTP Server 2.4.17 through 2.4.38 with MPM event, worker or prefork contains a use-after-free in scoreboard handling. Code running in a less-privileged child process or thread, including in-process scripting interpreters, can manipulate the scoreboard to execute arbitrary code as the parent process, typically root. Non-Unix systems are not affected.

Impact

An attacker who already has code execution in a child process gains root privileges on the host. This turns a limited web or script foothold into full system compromise.

Attack surface

The flaw is local, reached from code already executing inside an Apache child process or thread, including scripts run by an in-process interpreter. No user interaction is required, but the attacker needs a low-privileged execution context on the target, as reflected by the CVSS vector AV:L/PR:L/UI:N.

Exploitation

CVE-2019-0211 is listed in CISA KEV with a due date of 2022-05-03, and EPSS gives a 30-day probability of 0.65005 (99.2nd percentile). Multiple references are tagged Exploit, indicating public exploit code exists; KEV records no known ransomware campaign use.

What to do

• Upgrade Apache HTTP Server to 2.4.39 or later, or apply the vendor update for your distribution.
• Apply the referenced Red Hat, Debian, Ubuntu, SUSE, Oracle or NetApp advisories for packaged deployments.
• Reduce the number of untrusted scripts or modules running inside Apache child processes where feasible.
• Run Apache workers under a dedicated low-privilege account and restrict local access to the host.
• Verify the running httpd version after patching to confirm the fix is active.

Detection

• Monitor for unexpected child processes of httpd running as root or spawning shells.
• Alert on httpd processes accessing or modifying scoreboard-related shared memory in abnormal ways.
• Watch for local privilege escalation activity from web server accounts, including new root-owned processes.
• Audit installed httpd versions against the 2.4.17 to 2.4.38 affected range.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.