CVE-2019-0190
HighExploitedA remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service.
Published Jan 30, 2019 · Updated Sep 23, 2026 · Also known as ALPINE-CVE-2019-0190, DEBIAN-CVE-2019-0190
Key Facts
Patch immediately- CVE-2019-0190 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting HTTP Server (Apache), Enterprise Manager Ops Center (Oracle), Hospitality Guest Access (Oracle) and 21 more products.
- It is exploited in the wild, listed in Industry KEV feed since Feb 22, 2022. No public exploit code is known.
- EPSS estimates a 59% probability of exploitation in the next 30 days.
- Fixed versions are available, including apache 2.4.38-1, apache2 2.4.38-1, apache2 2.4.38-r0.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
59%
Higher than 99.1% of all scored CVEs
Exploited in the wild
Yes
1 catalog listing
Public exploit code
None known
Get the full CVE-2019-0190 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Feb 22, 2022 | n/a | Not reported |
Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Affected Products
67 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| HTTP ServerApache | 2.4.37, >= Apache HTTP Server 2.4.37 | n/a |
| Enterprise Manager Ops CenterOracle | 12.3.3 | n/a |
| Hospitality Guest AccessOracle | 4.2.0, 4.2.1 | n/a |
| Instantis EnterprisetrackOracle | 17.1, 17.2, 17.3 | n/a |
| Retail Xstore Point Of ServiceOracle | 7.0, 7.1 | n/a |
Patched Releases
apache
2.4.38-1
apache2
2.4.38-1, 2.4.38-r0
httpd
2.4.39-1.ph1, 2.4.39-1.ph2, 2.4.39-1.ph3
httpd24
2.4.38-1.86.amzn1
httpd24-devel
2.4.38-1.86.amzn1
httpd24-manual
2.4.38-1.86.amzn1
httpd24-tools
2.4.38-1.86.amzn1
mod24_ldap
2.4.38-1.86.amzn1
mod24_md
2.4.38-1.86.amzn1
mod24_proxy_html
1:2.4.38-1.86.amzn1
mod24_session
2.4.38-1.86.amzn1
mod24_ssl
1:2.4.38-1.86.amzn1
nxtgn-openssl
NA
openssl
NA
openssl-c_rehash
NA
openssl-devel
NA
openssl-docs
NA
openssl-perl
NA
rootio-apache2
2.4.38-1
Timeline
Publicly disclosed
Jan 30, 2019
Added to Industry KEV feed
Feb 22, 2022
Last updated
Sep 23, 2026
Weakness Type
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
References
- advisoryhttps://httpd.apache.org/security/vulnerabilities_24.html
- advisoryhttps://security.alpinelinux.org/vuln/CVE-2019-0190
- advisoryGLSA-201903-21
- advisoryhttps://security.netapp.com/advisory/ntap-20190125-0001/
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2019-0190
FAQ
Common Questions.
A bug exists in the way mod_ssl handled client renegotiations.
Affected: HTTP Server (Apache) versions 2.4.37, >= Apache HTTP Server 2.4.37; Enterprise Manager Ops Center (Oracle) versions 12.3.3; Hospitality Guest Access (Oracle) versions 4.2.0, 4.2.1, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Feb 22, 2022.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including apache 2.4.38-1, apache2 2.4.38-1, apache2 2.4.38-r0.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2019-0190 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo