Is CVE-2016-5387 being actively exploited?

CVE-2016-5387 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2016-5387?

CVE-2016-5387 has a CVSS 3.1 base score of 8.1 (HIGH).

CVE-2016-5387

HIGH · CVSS 8.1EPSS 55.7%EU EUVD

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.

Key facts

CVSS score: 8.1 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS score: 55.7% (99th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2016-6337)
Published: July 19, 2016
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2016-6337 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.

View on the EU Vulnerability Database

Affected products

apache / http server
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
debian / debian linux
fedoraproject / fedora
fedoraproject / fedora
hp / system management homepage
opensuse / leap
opensuse / opensuse
oracle / communications user data repository
oracle / enterprise manager ops center
oracle / enterprise manager ops center
oracle / linux
oracle / linux
oracle / linux
oracle / solaris
redhat / enterprise linux
redhat / enterprise linux
redhat / enterprise linux desktop
redhat / enterprise linux desktop
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux server
redhat / enterprise linux server
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server tus
redhat / enterprise linux server tus
redhat / enterprise linux server tus
redhat / enterprise linux server tus
redhat / enterprise linux workstation
redhat / enterprise linux workstation
redhat / jboss core services
redhat / jboss enterprise web server
redhat / jboss enterprise web server
redhat / jboss web server

Certified products that may be affected

29 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Oracle Linux 7 NSS Cryptographic Module - Oracle Corporation - FIPS 140 4586 - historical
Oracle Linux 7 Libreswan Cryptographic Module - Oracle Corporation - FIPS 140 4266 - historical
Oracle Linux 7 OpenSSH Client Cryptographic Module - Oracle Corporation - FIPS 140 4206 - historical
Oracle Linux 7 OpenSSH Server Cryptographic Module - Oracle Corporation - FIPS 140 4176 - historical
Oracle Linux 7 Unbreakable Enterprise Kernel (UEK 6) Cryptographic Module - Oracle Corporation - FIPS 140 4169 - historical

See all 29 in the Security Certifications Explorer.

References

http://lists.opensuse.org/opensuse-updates/2016-07/msg00059.html(Mailing List, Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-1624.html(Broken Link, Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-1625.html(Broken Link, Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-1648.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-1649.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-1650.html(Broken Link, Third Party Advisory)
http://www.debian.org/security/2016/dsa-3623(Third Party Advisory)
http://www.kb.cert.org/vuls/id/797896(Third Party Advisory, US Government Resource)
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html(Patch, Third Party Advisory)
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html(Patch, Third Party Advisory)
http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html(Third Party Advisory)
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html(Third Party Advisory)
http://www.securityfocus.com/bid/91816(Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id/1036330(Broken Link, Third Party Advisory, VDB Entry)
http://www.ubuntu.com/usn/USN-3038-1(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2016:1420(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2016:1421(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2016:1422(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2016:1635(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2016:1636(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2016:1851(Third Party Advisory)
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us(Third Party Advisory)
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149(Third Party Advisory)
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722(Third Party Advisory)
https://httpoxy.org/(Third Party Advisory)
https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain