CVE-2019-10098·Apache vulnerability
In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.
- Severity
- high
- Software
- Apache
- Fixed in
- 2.4.41-1
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 74% — in the top 0.5% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Affected versions
Until: 2.4.41-1
Fixed in: 2.4.41-1
How to fix this CVE
Update Apache HTTP Server to version 2.4.41-1 or later to patch the mod_rewrite URL redirection bypass vulnerability. This update eliminates the ability for attackers to manipulate redirect destinations using encoded newline characters. Organizations running Apache 2.4.0 through 2.4.39 should prioritize this update, particularly if mod_rewrite is actively used for request routing and security controls.
sudo dnf update httpdDefensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
GET|POST request containing RewriteRule directives or redirect logic with URI parameters including %0a, %0d, \x0a, or \x0d; log entry showing unexpected external domain in Location header when internal redirect was configuredWAF mitigation (if patching is not yet possible)
Add this rule to your WAF to block exploitation attempts while you schedule the patch.
Implement a WAF rule to block HTTP requests containing URL-encoded newline sequences (%0a, %0d, %5c%x) in the request URI or query string. Additionally, validate that Location headers in responses match whitelisted redirect domains and reject those pointing to unexpected external hosts.How to check if you are affected
- Check installed Apache version: apache2ctl -v or httpd -v — verify it reports 2.4.41-1 or higher
- Confirm mod_rewrite is loaded: grep -i 'mod_rewrite' /etc/apache2/mods-enabled/* or apachectl -M | grep rewrite
- Search Apache access logs for encoded newline characters in request URIs: grep -P '%0a|%0d|\\x0a|\\x0d' /var/log/apache2/access.log
- Verify the fix: Check the Apache package changelog with apt changelog apache2 or rpm -q --changelog httpd | head -20 and confirm the CVE-2019-10098 fix is present
Indicators of compromise
- %0a in URI parameter of mod_rewrite redirect request
- %0d in URI parameter of mod_rewrite redirect request
- Location header redirect to external domain when internal redirect configured
FAQ
What is CVE-2019-10098?
CVE-2019-10098 is a vulnerability in Apache's mod_rewrite module that allows attackers to bypass intended redirect rules by injecting encoded newline characters (%0a, %0d) into HTTP requests, causing the server to redirect users to unintended external URLs instead of self-referential destinations.
Is CVE-2019-10098 being actively exploited?
No, CVE-2019-10098 is not listed in CISA's Known Exploited Vulnerabilities catalog. However, public exploits exist (such as ExploitDB #47689), making opportunistic attacks possible.
What versions of Apache are affected by CVE-2019-10098?
Apache HTTP Server versions 2.4.0 through 2.4.39 are vulnerable. Version 2.4.41-1 and later contain the fix.
How do I check if my server is vulnerable to CVE-2019-10098?
Run 'apache2ctl -v' or 'httpd -v' and check if the version is between 2.4.0 and 2.4.39. If mod_rewrite is enabled ('apachectl -M | grep rewrite'), your server is vulnerable if not updated to 2.4.41-1 or later.
Does Defensia detect CVE-2019-10098?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Apache is installed on a monitored server, CVE-2019-10098 will appear in your dashboard with remediation steps.
Related Apache CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2019-10098. Free for 1 server.
Get started free