CVE-2019-10098: Apache HTTP Server mod_rewrite redirect bypass via encoded newlines

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityMedium severity open redirect with no known in-the-wild exploitation or KEV listing, but a very high EPSS score and wide Apache HTTP Server deployment warrant prompt patching.

What it is

Apache HTTP Server 2.4.0 through 2.4.39 can be tricked when mod_rewrite redirects intended to be self-referential are manipulated with encoded newlines, causing the redirect to point to an unexpected URL within the request URL. This is an open redirect (CWE-601) that undermines the assumption that such redirects stay on the same host.

Impact

An attacker can redirect a victim to an attacker-chosen URL, enabling phishing, credential theft or malware delivery under the guise of a trusted site. The CVSS scope change (S:C) reflects that the impact crosses from the vulnerable server to the user's browser session.

Attack surface

Reached over the network via a crafted HTTP request to a mod_rewrite redirect rule; no authentication is required, but the victim must interact (click a link or follow the redirect), per the CVSS vector UI:R.

Exploitation

Not listed in CISA KEV and no exploit tag appears in the references, but EPSS is high at 0.73981 (99.4th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Apache HTTP Server to a version after 2.4.39 that contains the fix, per the vendor advisory.
• Audit mod_rewrite rules that perform self-referential redirects and avoid relying on request-derived values for redirect targets.
• Where possible, replace dynamic redirect targets with explicit allowlists of permitted destinations.
• Add user-facing warnings or interstitial pages for outbound redirects to reduce phishing effectiveness.

Detection

• Review web server access logs for requests containing encoded newline sequences (%0a, %0d) in URLs that trigger redirects.
• Monitor for 3xx responses whose Location header points to a different host than the request Host header.
• Correlate mod_rewrite rule hits with unusual redirect destinations or spikes in outbound redirects.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.