CVE-2020-11984: Apache HTTP Server mod_proxy_uwsgi buffer overflow allows info disclosure and RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, and high EPSS probability make this a top remediation priority despite absence from KEV.

What it is

Apache HTTP Server versions 2.4.32 through 2.4.44 contain a classic buffer overflow (CWE-120) in the mod_proxy_uwsgi module. The flaw can leak memory contents and, depending on memory layout, may be leveraged for remote code execution. It matters because the affected module is reachable over the network without authentication and the CVSS base score is 9.8 critical.

Impact

An unauthenticated remote attacker can read process memory, exposing sensitive data, and may achieve arbitrary code execution in the context of the httpd process.

Attack surface

Reachable over the network via HTTP requests handled by mod_proxy_uwsgi; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS 30-day probability is 0.90039 (99.788th percentile) and a public exploit reference exists on Packet Storm, indicating high likelihood of exploitation.

What to do

• Upgrade Apache HTTP Server to a version later than 2.4.44 that contains the fix for mod_proxy_uwsgi.
• If mod_proxy_uwsgi is not required, disable or remove the module and any related proxy configuration.
• Apply vendor patches for downstream distributions and products (Canonical, Debian, Fedora, openSUSE, Oracle, NetApp) that bundle the affected httpd.
• Restrict network access to httpd instances using mod_proxy_uwsgi to trusted clients where feasible.
• Monitor Apache security advisories and vendor bulletins for updated guidance.

Detection

• Inspect httpd error and access logs for malformed or anomalous requests targeting uwsgi proxy paths.
• Monitor for unexpected httpd process crashes or restarts that could indicate memory corruption attempts.
• Use network detection to flag unusual request patterns to mod_proxy_uwsgi endpoints.
• Check deployed httpd versions and module inventories to identify hosts still running 2.4.32 through 2.4.44 with mod_proxy_uwsgi enabled.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.