High 7.8Known exploited (CISA KEV)Published Apr 8, 2019

CVE-2019-0211In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scrip…

Updated under an hour ago (Oct 26, 2026, 6:00 PM ET)

Does this affect you?

It affects Apache HTTP Server and 26 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Nov 3, 2021; federal agencies had to remediate by May 3, 2022. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Apache HTTP Server

Exploited in the last 30 days

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

CVSS: 7.8 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Added to CISA KEV Nov 3, 2021; federal remediation due May 3, 2022Apply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 65.00% (percentile 99)
Assigned by: apache
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Apache Apache HTTP Server apache:http_server (from the name)	2.4.17 to 2.4.38	CNA record
apache http_server apache:http_server	from 2.4.17 through 2.4.38	NVD
fedoraproject fedora fedoraproject:fedora	28; 29; 30	NVD
canonical ubuntu_linux canonical:ubuntu_linux	14.04; 16.04; 18.04; 18.10	NVD
debian debian_linux debian:debian_linux	9.0	NVD
opensuse leap opensuse:leap	15.0; 42.3	NVD
netapp oncommand_unified_manager netapp:oncommand_unified_manager	all versions	NVD
redhat jboss_core_services redhat:jboss_core_services	1.0	NVD
redhat openshift_container_platform redhat:openshift_container_platform	3.11	NVD
redhat openshift_container_platform_for_power redhat:openshift_container_platform_for_power	3.11_ppc64le	NVD
1–10 of 28

References

References

http://www.openwall.com/lists/oss-security/2019/04/02/3	mailing-list, x-refsource-mlist, third-party-advisory
http://www.securityfocus.com/bid/107666	vdb-entry, x-refsource-bid, broken-link, third-party-advisory
https://seclists.org/bugtraq/2019/Apr/5	mailing-list, x-refsource-bugtraq
https://www.synology.com/security/advisory/Synology_SA_19_14	x-refsource-confirm
http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html	x-refsource-misc, third-party-advisory, vdb-entry
https://usn.ubuntu.com/3937-1/	vendor-advisory, x-refsource-ubuntu
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/	vendor-advisory, x-refsource-fedora
https://www.debian.org/security/2019/dsa-4422	vendor-advisory, x-refsource-debian
https://lists.apache.org/thread.html/b1613d44ec364c87bb7ee8c5939949f9b061c05c06e0e90098ebf7aa%40%3Cusers.httpd.apache.org%3E	mailing-list, x-refsource-mlist
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7/	vendor-advisory, x-refsource-fedora
1–10 of 36

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.