critical CVSS 9 EPSS 17% Public exploit available

CVE-2002-1850·Apache vulnerability

mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write deadlock between httpd and the CGI script.

Severity
critical
Software
Apache
Fixed in
2.0.42-1
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 17% — in the top 3% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 2.0.42-1

Fixed in: 2.0.42-1

How to fix this CVE

Upgrade Apache to version 2.0.42-1 or later to resolve a resource exhaustion vulnerability in mod_cgi that can be triggered when CGI scripts write excessive data to stderr. This fix prevents the read/write deadlock condition that causes the web server to hang and consume memory. Administrators should prioritize this update, especially on production servers that execute untrusted CGI scripts.

sudo dnf update httpd

Defensia detects this vulnerability

How to check if you are affected

  1. Check installed Apache version: apache2ctl -v | grep 'Server version'
  2. Verify mod_cgi is loaded: apache2ctl -M | grep cgi_module
  3. Search Apache error logs for CGI processes hanging: grep -i 'child pid.*exit signal' /var/log/apache2/error.log
  4. Confirm the patched version is installed: apt-cache policy apache2 | grep 'Installed' or rpm -q httpd

FAQ

What is CVE-2002-1850?

CVE-2002-1850 is a denial-of-service vulnerability in Apache's mod_cgi module where a CGI script that writes large amounts of data to stderr can create a bidirectional I/O deadlock between the web server and the script, causing httpd to hang and consume excessive memory resources.

Is CVE-2002-1850 being actively exploited?

This CVE is not listed on CISA's Known Exploited Vulnerabilities catalog, though public exploits have been documented. The vulnerability is primarily a local denial-of-service issue, limiting remote exploitation scenarios.

What versions of Apache are affected by CVE-2002-1850?

Apache 2.0.39 through 2.0.42-0 are vulnerable. The fix is available in Apache 2.0.42-1 and later releases.

How do I check if my server is vulnerable to CVE-2002-1850?

Run 'apache2ctl -v' and check if the version is 2.0.39, 2.0.40, 2.0.41, or 2.0.42 (pre-patch). Also confirm mod_cgi is enabled with 'apache2ctl -M | grep cgi_module'.

Does Defensia detect CVE-2002-1850?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Apache is installed on a monitored server, CVE-2002-1850 will appear in your dashboard with remediation steps.

Related Apache CVEs

CVE-2026-29167CVSS 10Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
CVE-2021-41773CVSS 10A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
CVE-2026-44631CVSS 10Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
CVE-2021-42013CVSS 10It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
CVE-2021-44790CVSS 10A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2002-1850. Free for 1 server.

Get started free