kbrain

CVE-2008-0456

LOW · CVSS 2.6EPSS 19.0%EU EUVD

CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.

Key facts

CVSS score
2.6 (v2.0)
Severity
LOW
CVSS vector
AV:N/AC:H/Au:N/C:N/I:P/A:N
Weakness (CWE)
CWE-74
EPSS score
19.0% (97th percentile)
In CISA KEV
No
In EU EUVD
Yes (EUVD-2008-0466)
Published
January 25, 2008
NVD last modified
June 16, 2026
Status
Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2008-0466 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.

View on the EU Vulnerability Database

Affected products

  • apache / http server
  • redhat / enterprise linux desktop
  • redhat / enterprise linux server
  • redhat / enterprise linux workstation

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

References

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain