CVE-2019-0211

In Apache HTTP Server 2.4 releases 2.4.17 through 2.4.38, a use-after-free flaw (CWE-416) in scoreboard handling allows code running in less-privileged child processes or threads — including in-process scripting interpreters such as mod_php — to execute arbitrary code with the privileges of the parent process, which is usually root. All three standard multi-processing modules (event, worker, and prefork) are affected on Unix-like systems; non-Unix systems such as Windows are not affected. An attacker who can already run code inside the web server process, for example a shared-hosting customer running PHP, gains root privileges on the host, putting every site and service on that server at risk. The flaw is rated 7.8 (high), a public proof-of-concept exploit known as 'Carpe Diem' has been released, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild; EPSS puts the 30-day exploitation probability at 65% (99th percentile). Public scans reported in news coverage counted more than 2 million Apache HTTP servers running affected versions, with shared web hosting environments highlighted as most at risk.

What to do: Upgrade Apache HTTP Server to a fixed release (2.4.39 or later) or apply patched packages from your OS/vendor — Apache, Fedora, Canonical/Ubuntu, Debian, openSUSE, NetApp, Red Hat, and Oracle have shipped fixes — as required by the CISA KEV catalog. Prioritize internet-facing and shared-hosting servers that run in-process scripting such as mod_php, and verify the running version (e.g. 'apachectl -v' or 'httpd -v') is outside the 2.4.17–2.4.38 range. Note that Windows and other non-Unix installations are not affected.