CVE-2004-0493
MediumPublic exploitThe ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of…
Published Aug 6, 2004 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2004-0493
Key Facts
Patch immediately- CVE-2004-0493 is a medium-severity vulnerability (CVSS 6.4 v2) affecting HTTP Server (Apache), Converged Communications Server (Avaya), S8300 (Avaya) and 7 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 85% probability of exploitation in the next 30 days.
- Fixed versions are available, including apache2 2.0.50-1, httpd 0:2.0.46-32.ent.3, rootio-apache2 2.0.50-1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
6.4
AV:N/AC:L/Au:N/C:N/I:P/A:P
EPSS (30-day exploit likelihood)
85%
Higher than 99.7% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2004-0493 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.
Affected Products
30 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| HTTP ServerApache | 2.0.47, 2.0.48, 2.0.49, 2.0.42, 2.0.42.1, 2.0.42.2, 2.0.47.1 | n/a |
| Converged Communications ServerAvaya | 2.0 | n/a |
| S8300Avaya | r2.0.0 | n/a |
| S8500Avaya | r2.0.0 | n/a |
| S8700Avaya | r2.0.0 | n/a |
Patched Releases
apache2
2.0.50-1
httpd
0:2.0.46-32.ent.3
rootio-apache2
2.0.50-1
Timeline
Publicly disclosed
Aug 6, 2004
Last updated
Aug 4, 2026
References
- advisoryRHSA-2004:342
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2004-0493
- patch10619
- exploitExploitDB-360
- exploitExploitDB-371
FAQ
Common Questions.
The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.
Affected: HTTP Server (Apache) versions 2.0.47, 2.0.48, 2.0.49, 2.0.42, 2.0.42.1, 2.0.42.2, 2.0.47.1; Converged Communications Server (Avaya) versions 2.0; S8300 (Avaya) versions r2.0.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including apache2 2.0.50-1, httpd 0:2.0.46-32.ent.3, rootio-apache2 2.0.50-1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2004-0493 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo