CVE-2014-0226
MediumPublic exploitRace condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers…
Published Jul 20, 2014 · Updated Aug 11, 2026 · Also known as DEBIAN-CVE-2014-0226, UBUNTU-CVE-2014-0226
Key Facts
Patch immediately- CVE-2014-0226 is a medium-severity vulnerability (CVSS 6.8 v2) affecting HTTP Server (Apache), Enterprise Manager Ops Center (Oracle), Secure Global Desktop (Oracle) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 86% probability of exploitation in the next 30 days.
- Fixed versions are available, including antlr-eap6 0:2.7.7-17.redhat_4.1.ep6.el5, antlr-eap6 0:2.7.7-17.redhat_4.1.ep6.el6, HTTP Server 2.2.29.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS (30-day exploit likelihood)
86%
Higher than 99.7% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2014-0226 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.
Affected Products
417 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| HTTP ServerApache | 10.1.3.5.0, 11.1.1.7.0, 12.1.2.0, 12.1.3.0 | 2.2.29 |
| Enterprise Manager Ops CenterOracle | 11.1.3, 12.1.4 | n/a |
| Secure Global DesktopOracle | 4.63, 4.71, 5.0, 5.1 | n/a |
| Jboss Enterprise Application PlatformRedhat | 6.0.0, 6.4.0 | n/a |
| Debian LinuxDebian | 7.0, 8.0 | n/a |
Patched Releases
antlr-eap6
0:2.7.7-17.redhat_4.1.ep6.el5, 0:2.7.7-17.redhat_4.1.ep6.el6
HTTP Server
2.2.29
apache-commons-beanutils-eap6
0:1.8.3-7.redhat_6.1.ep6.el5, 0:1.8.3-7.redhat_6.1.ep6.el6
apache-commons-cli-eap6
0:1.2-6.redhat_4.1.ep6.el5, 0:1.2-6.redhat_4.1.ep6.el6
apache-commons-codec-eap6
0:1.4-16.redhat_3.1.ep6.el5, 0:1.4-16.redhat_3.1.ep6.el6
apache-commons-collections-eap6
0:3.2.1-15.redhat_3.1.ep6.el5, 0:3.2.1-15.redhat_3.1.ep6.el6
apache-commons-configuration-eap6
0:1.6-1.redhat_3.1.ep6.el5, 0:1.6-1.redhat_3.1.ep6.el6
apache-commons-daemon-eap6
1:1.0.15-5.redhat_1.ep6.el5, 1:1.0.15-5.redhat_1.ep6.el6
apache-commons-daemon-jsvc-eap6
1:1.0.15-6.redhat_2.ep6.el5, 1:1.0.15-6.redhat_2.ep6.el6
apache-commons-io-eap6
0:2.1-8.redhat_3.1.ep6.el5, 0:2.1-8.redhat_3.1.ep6.el6
apache-commons-lang-eap6
0:2.6-8.redhat_3.1.ep6.el5, 0:2.6-8.redhat_3.1.ep6.el6
apache-commons-logging-eap6
0:1.1.1-7.9_redhat_1.ep6.el6
apache-commons-pool-eap6
0:1.6-7.redhat_6.1.ep6.el5, 0:1.6-7.redhat_6.1.ep6.el6
apache-mime4j
0:0.6-10.redhat_3.1.ep6.el5, 0:0.6-10.redhat_3.1.ep6.el6
apache2
2.2.12-1.50.1, 2.2.16-6+squeeze13, 2.2.22-13+deb7u3, 2.4.10-1, 2.4.23-4.1, 2.4.7-1ubuntu4.1
apache2-devel
2.2.12-1.50.1, 2.4.23-4.1
apache2-doc
2.2.12-1.50.1, 2.4.23-4.1
apache2-event
2.4.23-4.1
apache2-example-pages
2.2.12-1.50.1, 2.4.23-4.1
apache2-prefork
2.2.12-1.50.1, 2.4.23-4.1
apache2-utils
2.2.12-1.50.1, 2.4.23-4.1
apache2-worker
2.2.12-1.50.1, 2.4.23-4.1
cal10n-eap6
0:0.7.3-2.redhat_4.1.ep6.el5, 0:0.7.3-2.redhat_4.1.ep6.el6
codehaus-jackson
0:1.9.9-7.redhat_3.ep6.el5, 0:1.9.9-7.redhat_3.ep6.el6
dom4j-eap6
0:1.6.1-20.redhat_6.1.ep6.el5, 0:1.6.1-20.redhat_6.1.ep6.el6
Timeline
Publicly disclosed
Jul 20, 2014
Last updated
Aug 11, 2026
Weakness Type
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- CWE-787 Out-of-bounds Write
References
- advisoryhttp://advisories.mageia.org/MGASA-2014-0304.html
- advisoryhttp://advisories.mageia.org/MGASA-2014-0305.html
- advisorySSRT102066
- advisoryHPSBMU03380
- advisoryHPSBMU03409
FAQ
Common Questions.
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the s…
Affected: HTTP Server (Apache) versions 10.1.3.5.0, 11.1.1.7.0, 12.1.2.0, 12.1.3.0; Enterprise Manager Ops Center (Oracle) versions 11.1.3, 12.1.4; Secure Global Desktop (Oracle) versions 4.63, 4.71, 5.0, 5.1, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including antlr-eap6 0:2.7.7-17.redhat_4.1.ep6.el5, antlr-eap6 0:2.7.7-17.redhat_4.1.ep6.el6, HTTP Server 2.2.29.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2014-0226 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo