Skip to content
Fencer Vulns
low 2.6

CVE-2008-0456 json

CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earl…

published 2008-01-25 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-0466

cvss
2.6
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
19.0%
EPSS 19.0% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.

Patch / fix

  • apache http_server 2.2.12
  • httpd RHEL 5 2.2.3-74.el5
  • mod_ssl RHEL 5 1:2.2.3-74.el5
  • httpd-manual RHEL 5 2.2.3-74.el5

red hat advisories RHSA-2013:0130

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2008-0456 updated cvss 2.6

httpd: mod_negotiation CRLF injection via untrusted file names in directories with MultiViews enabled

  • Red Hat Enterprise Linux (v. 5 server) httpd 2.2.3-74.el5, mod_ssl 2.2.3-74.el5, httpd-manual 2.2.3-74.el5 Red Hat Enterprise Linux Desktop (v. 5 client) httpd 2.2.3-74.el5, mod_ssl 2.2.3-74.el5 Red Hat Enterprise Linux Desktop Workstation (v. 5 client) httpd 2.2.3-74.el5, httpd-manual 2.2.3-74.el5
    fixed: vendor fix RHSA-2013:0130
  • Red Hat Enterprise Linux 6 httpd, mod_ssl, httpd-tools, httpd-manual
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

19.04% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • securityreason.com http://securityreason.com/securityalert/3575 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.