Is CVE-2010-0434 being actively exploited?

CVE-2010-0434 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2010-0434?

CVE-2010-0434 has a CVSS 2.0 base score of 4.3 (MEDIUM).

CVE-2010-0434

MEDIUM · CVSS 4.3EPSS 18.4%EU EUVD

The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.

Key facts

CVSS score: 4.3 (v2.0)
Severity: MEDIUM
CVSS vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness (CWE): CWE-200
EPSS score: 18.4% (97th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2010-0465)
Published: March 5, 2010
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2010-0465 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.

View on the EU Vulnerability Database

Affected products

apache / http server
debian / debian linux
debian / debian linux
fedoraproject / fedora
fedoraproject / fedora

References

http://httpd.apache.org/security/vulnerabilities_22.html(Patch, Vendor Advisory)
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html(Broken Link, Mailing List)
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html(Mailing List, Third Party Advisory)
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html(Mailing List, Third Party Advisory)
http://lists.vmware.com/pipermail/security-announce/2010/000105.html(Mailing List, Third Party Advisory)
http://marc.info/?l=bugtraq&m=127557640302499&w=2(Issue Tracking, Mailing List, Third Party Advisory)
http://secunia.com/advisories/39100(Not Applicable)
http://secunia.com/advisories/39115(Not Applicable)
http://secunia.com/advisories/39501(Not Applicable)
http://secunia.com/advisories/39628(Not Applicable)
http://secunia.com/advisories/39632(Not Applicable)
http://secunia.com/advisories/39656(Not Applicable)
http://secunia.com/advisories/40096(Not Applicable)
http://support.apple.com/kb/HT4435(Broken Link)
http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/server/protocol.c?r1=917617&r2=917867&pathrev=917867&diff_format=h(Patch, Vendor Advisory)
http://svn.apache.org/viewvc?view=revision&revision=917867(Patch, Vendor Advisory)
http://svn.apache.org/viewvc?view=revision&revision=918427(Patch, Vendor Advisory)
http://www-01.ibm.com/support/docview.wss?uid=swg1PM08939(Third Party Advisory)
http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247(Third Party Advisory)
http://www-01.ibm.com/support/docview.wss?uid=swg1PM15829(Third Party Advisory)
http://www.debian.org/security/2010/dsa-2035(Third Party Advisory)
http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html(Third Party Advisory)
http://www.redhat.com/support/errata/RHSA-2010-0168.html(Third Party Advisory)
http://www.redhat.com/support/errata/RHSA-2010-0175.html(Third Party Advisory)
http://www.securityfocus.com/bid/38494(Third Party Advisory, VDB Entry)
http://www.vmware.com/security/advisories/VMSA-2010-0014.html(Third Party Advisory)
http://www.vupen.com/english/advisories/2010/0911(Permissions Required)
http://www.vupen.com/english/advisories/2010/0994(Permissions Required)
http://www.vupen.com/english/advisories/2010/1001(Permissions Required)
http://www.vupen.com/english/advisories/2010/1057(Permissions Required)
http://www.vupen.com/english/advisories/2010/1411(Permissions Required)
https://bugzilla.redhat.com/show_bug.cgi?id=570171(Issue Tracking, Third Party Advisory)
https://exchange.xforce.ibmcloud.com/vulnerabilities/56625(Third Party Advisory, VDB Entry)
https://issues.apache.org/bugzilla/show_bug.cgi?id=48359(Issue Tracking, Vendor Advisory)
https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain