Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions…

Description

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.

Scores

EPSS (exploitation in 30 days)

97.1% · top 0.1% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.6.

Weakness

• n/a
• CWE-189 (opens in a new tab)All about CWE-189 and its CVEs

Affected products

• n/a

  • affected n/a

References (90)

• 21266 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 21307 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• HPSBMA02250 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• ADV-2006-3995 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• apache-modrewrite-offbyone-bo(28063) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• 102662 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
• SSRT071293 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• http://www-1.ibm.com/support/docview.wss?uid=swg27007951 (opens in a new tab)x_refsource_CONFIRMx_transferred
• SSRT061265 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• ADV-2006-4300 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 20060728 [Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Released (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• 23028 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://svn.apache.org/viewvc?view=rev&revision=426144 (opens in a new tab)x_refsource_MISCx_transferred
• ADV-2006-3282 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 21284 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• PK29156 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
• http://kbase.redhat.com/faq/FAQ_68_8653.shtm (opens in a new tab)x_refsource_MISCx_transferred
• 22523 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2008-1246 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• SSRT090208 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• 23260 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2006-3264 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• SUSE-SA:2006:043 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• ADV-2008-0924 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 21313 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 29849 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2006-4015 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 21273 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• TA08-150A (opens in a new tab)third-party-advisoryx_refsource_CERTx_transferred
• 21478 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 20060728 Apache mod_rewrite Buffer Overflow Vulnerability (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• GLSA-200608-01 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• 20060728 [Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Released (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 22368 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 26329 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• HPSBUX02145 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 102663 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
• 29420 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www.apache.org/dist/httpd/Announcement2.0.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 19204 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• 21245 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2006-4868 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• APPLE-SA-2008-03-18 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• 30430 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2006-4207 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• APPLE-SA-2008-05-28 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• MDKSA-2006:133 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• 21315 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• VU#395412 (opens in a new tab)third-party-advisoryx_refsource_CERT-VNx_transferred
• 21509 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 21346 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 1016601 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• http://docs.info.apple.com/article.html?artnum=307562 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 20060728 rPSA-2006-0139-1 httpd mod_ssl (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• DSA-1131 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• 21247 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2006-3884 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• ADV-2008-1697 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 20060820 POC & exploit for Apache mod_rewrite off-by-one (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• https://issues.rpath.com/browse/RPL-538 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 22262 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• OpenPKG-SA-2006.015 (opens in a new tab)vendor-advisoryx_refsource_OPENPKGx_transferred
• 1312 (opens in a new tab)third-party-advisoryx_refsource_SREASONx_transferred
• DSA-1132 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• PK29154 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
• 21241 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2006-3017 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• ADV-2007-2783 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 20060728 Apache 1.3.29/2.X mod_rewrite Buffer Overflow Vulnerability CVE-2006-3747 (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• USN-328-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• PK27875 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
• 27588 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 2006-0044 (opens in a new tab)vendor-advisoryx_refsource_TRUSTIXx_transferred
• 22388 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 21197 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210330 svn commit: r1888194 [4/13] - /httpd/site/trunk/content/security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210330 svn commit: r1073139 [4/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210330 svn commit: r1073149 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2006-3747](https://trackcve.app/badge/CVE-2006-3747.svg)](https://trackcve.app/cve/CVE-2006-3747)

Record last updated 7 Aug 2024, 18:39 UTC.