Skip to content
Fencer Vulns
high 7.6

CVE-2006-3747 in the critical feed json

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions befor…

published 2006-07-28 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-3741

cvss
7.6
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
97.1%
EPSS 97.1% chance of exploitation in 30 days, percentile 99.8%
public exploits
5
Metasploit, Exploit-DB

Summary

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.

Patch / fix

  • apache http_server 1.3.37, 2.0.59, 2.2.3
  • apache2 Debian 14, Debian 13, Debian 12 2.0.55-4.1

debian advisories DEBIAN-CVE-2006-3747

  • apache2 openSUSE Tumbleweed 2.4.49-1.1

opensuse advisories openSUSE-SU-2024:10623-1

Timeline

  1. First public exploit (Metasploit exploit/windows/http/apache_mod_rewrite_ldap)
  2. Published

Exploit prediction

97.13% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/windows/http/apache_mod_rewrite_ldap Apache Module mod_rewrite LDAP Protocol Buffer Overflow metasploit exploit, great rank, 2006-07-28
  • EDB-16752 Apache mod_rewrite - LDAP protocol Buffer Overflow (Metasploit) remote, 2010-02-15
  • EDB-3996 Apache 2.0.58 mod_rewrite (Windows 2003) - Remote Overflow remote, 2007-05-26
  • EDB-3680 Apache mod_rewrite (Windows x86) - Off-by-One Remote Overflow remote, 2007-04-07
  • EDB-2237 Apache < 1.3.37/2.0.59/2.2.3 mod_rewrite - Remote Overflow remote, 2006-08-21

CVSS scores

assigned by version score vector
NVD 2.0 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.