Vulnerability record · CVE-2019-10097 · published 26 September 2019
CVE-2019-10097: Apache HTTP Server mod_remoteip PROXY header buffer overflow
Apache · Http Server
Apache HTTP Server 2.4.32 through 2.4.39 mishandles a crafted PROXY protocol header when mod_remoteip is configured to trust an intermediary proxy, causing a stack buffer overflow or NULL pointer dereference. The flaw matters because it can crash or potentially corrupt the server process, but it is reachable only from a trusted proxy, not from arbitrary HTTP clients.
Description
In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 7.2 with high confidentiality, integrity and availability impact and a very high EPSS percentile, though exploitation requires a trusted proxy position.
What it is
Apache HTTP Server 2.4.32 through 2.4.39 mishandles a crafted PROXY protocol header when mod_remoteip is configured to trust an intermediary proxy, causing a stack buffer overflow or NULL pointer dereference. The flaw matters because it can crash or potentially corrupt the server process, but it is reachable only from a trusted proxy, not from arbitrary HTTP clients.
Impact
An attacker controlling or compromising the trusted proxy gains the ability to crash the Apache process and, via the out-of-bounds write, potentially execute code in the server's context. Untrusted clients cannot reach the flaw directly.
Attack surface
Reached over the network through the PROXY protocol header sent by a trusted intermediary proxy to a server running mod_remoteip. No user interaction is needed, but the CVSS vector requires high privileges (PR:H), consistent with the trusted-proxy precondition.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented; EPSS shows a 30-day probability of 0.52873 (98.9th percentile), indicating high predicted activity. References are vendor and third-party advisories only, with no public exploit tag.
What to do
- Upgrade Apache HTTP Server to a version after 2.4.39 that contains the fix.
- Apply vendor errata such as Red Hat RHSA-2019:4126 and Oracle CPU patches for affected bundled products.
- If mod_remoteip with PROXY protocol cannot be removed, restrict which hosts may act as the trusted proxy and validate their configuration.
- Review mod_remoteip RemoteIPTrustedProxy settings to ensure only intended intermediaries are trusted.
- Monitor for crashes or restarts of httpd processes on hosts using mod_remoteip.
Detection
- Search httpd error and system logs for segfaults, aborts or unexpected restarts on servers with mod_remoteip enabled.
- Inspect httpd configuration for mod_remoteip and PROXY protocol usage to inventory exposed instances.
- Monitor network traffic from trusted proxies for malformed or oversized PROXY headers.
- Correlate host-level crash dumps or core files from httpd with proxy-sourced connections.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-10097 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-10097), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
