{"id":"CVE-2019-0211","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-0211","generatedAt":"2026-10-29T01:00:09.056Z","title":"Apache HTTP Server Privilege Escalation Vulnerability","description":"In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.","published":"2019-04-08T22:29:00.000Z","lastModified":"2026-06-17T02:07:59.000Z","status":"Analyzed","sourceIdentifier":"security@apache.org","cvss":{"version":"3.1","score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-416"],"affected":["apache/http server","fedoraproject/fedora","canonical/ubuntu linux","debian/debian linux","opensuse/leap","netapp/oncommand unified manager","redhat/jboss core services","redhat/openshift container platform","redhat/openshift container platform for power","redhat/software collections","redhat/enterprise linux","redhat/enterprise linux eus","redhat/enterprise linux for arm 64","redhat/enterprise linux for arm 64 eus","redhat/enterprise linux for ibm z systems","redhat/enterprise linux for ibm z systems eus","redhat/enterprise linux for power little endian","redhat/enterprise linux for power little endian eus","redhat/enterprise linux server aus","redhat/enterprise linux server tus","redhat/enterprise linux update services for sap solutions","oracle/communications session report manager","oracle/communications session route manager","oracle/enterprise manager ops center","oracle/http server","oracle/instantis enterprisetrack","oracle/retail xstore point of service"],"epss":{"score":0.65005,"percentile":0.99245,"date":"2026-10-27","history":[]},"kev":{"listed":true,"dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","notes":"Apply updates per vendor instructions.\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-0211"},"exploits":{"count":1,"verified":false,"firstPublished":"2019-04-08","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":46676,"kind":"exploit","title":"Apache 2.4.17 < 2.4.38 - 'apache2ctl graceful' 'logrotate' Local Privilege Escalation","url":"https://www.exploit-db.com/exploits/46676","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/local/46676.php","file":"exploits/linux/local/46676.php","published":"2019-04-08","added":"2019-04-08","updated":"2019-04-08","author":"cfreal","type":"local","platform":"linux","port":null,"verified":false,"codes":["CVE-2019-0211"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://github.com/cfreal/exploits/blob/ba026fae59974037d744a90cef09224f751bc3e4/CVE-2019-0211-apache/cfreal-carpediem.php"}]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 3 May 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html","tags":["Broken Link","Mailing List","Release Notes","Third Party Advisory"],"source":"security@apache.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html","tags":["Broken Link","Mailing List","Release Notes","Third Party Advisory"],"source":"security@apache.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html","tags":["Broken Link","Third Party Advisory"],"source":"security@apache.org"},{"url":"http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html","tags":["Third Party Advisory","VDB Entry"],"source":"security@apache.org"},{"url":"http://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"security@apache.org"},{"url":"http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"security@apache.org"},{"url":"http://www.apache.org/dist/httpd/CHANGES_2.4.39","tags":["Broken Link","Vendor Advisory"],"source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2019/04/02/3","tags":["Mailing List","Third Party Advisory"],"source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2019/07/26/7","tags":["Mailing List"],"source":"security@apache.org"},{"url":"http://www.securityfocus.com/bid/107666","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHBA-2019:0959","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:0746","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:0980","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:1296","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:1297","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:1543","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["Vendor Advisory"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/890507b85c30adf133216b299cc35cd8cd0346a885acfc671c04694e%40%3Cdev.community.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/b1613d44ec364c87bb7ee8c5939949f9b061c05c06e0e90098ebf7aa%40%3Cusers.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/b2bdb308dc015e771ba79c0586b2de6fb50caa98b109833f5d4daf28%40%3Cdev.community.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/de881a130bc9cb2f3a9ff220784520556884fb8ea80e69400a45509e%40%3Cdev.community.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/fd110f4ace2d8364c7d9190e1993cde92f79e4eb85576ed9285686ac%40%3Ccvs.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E","tags":["Mailing List","Patch"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E","tags":["Mailing List"],"source":"security@apache.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN/","tags":["Release Notes"],"source":"security@apache.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7/","tags":["Release Notes"],"source":"security@apache.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/","tags":["Release Notes"],"source":"security@apache.org"},{"url":"https://seclists.org/bugtraq/2019/Apr/16","tags":["Mailing List","Patch","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://seclists.org/bugtraq/2019/Apr/5","tags":["Mailing List","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://security.gentoo.org/glsa/201904-20","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://security.netapp.com/advisory/ntap-20190423-0001/","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://support.f5.com/csp/article/K32957101","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://usn.ubuntu.com/3937-1/","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.debian.org/security/2019/dsa-4422","tags":["Mailing List","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.exploit-db.com/exploits/46676/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["Patch","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["Patch","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["Patch","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.synology.com/security/advisory/Synology_SA_19_14","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html","tags":["Broken Link","Mailing List","Release Notes","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html","tags":["Broken Link","Mailing List","Release Notes","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html","tags":["Broken Link","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.apache.org/dist/httpd/CHANGES_2.4.39","tags":["Broken Link","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2019/04/02/3","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2019/07/26/7","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-0211","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}