{"id":"CVE-2006-20001","published":"2023-01-17T19:07:27Z","modified":"2025-02-13T16:27:07Z","title":"Apache HTTP Server: mod_dav out of bounds read, or write of zero byte","vendor":"Apache Software Foundation","product":"Apache HTTP Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache HTTP Server","versions":[">= 2.4, <= 2.4.54"]}],"description":{"text":"A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.\n\nThis issue affects Apache HTTP Server 2.4.54 and earlier.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.03583,"percentile":0.89369,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"ACTUALIZACION | Oracle Critical Patch Update Advisory - July 2023","url":"https://otx.alienvault.com/pulse/64bace8d5d470a6a7baaa8a9","created":"2023-07-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["vendor-advisory"]},{"url":"https://security.gentoo.org/glsa/202309-01","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20230316-0005/","tags":[]}],"techniques":[],"reports":[{"id":"SRC-b804e28bf5894dd4955f","title":"Whitepaper Name Goes","publisher":"trustwave.com","url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/Trustwave_SpiderLabs_2023_Hospitality_Sector_Threat_Landscape.pdf","date":null,"mentions":[{"quote":"▪ Mod_dav module of httpd DoS (CVE-2006-20001)","start":45599,"end":45645}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2006-2000","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2006-2000","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2023-02-07","earliestUrl":"https://github.com/r1az4r/CVE-2006-20001","repos":[{"name":"r1az4r/CVE-2006-20001","url":"https://github.com/r1az4r/CVE-2006-20001","stars":0,"created":"2023-02-07"}]},"first":{"date":"2023-02-07","source":"PoC-in-GitHub","url":"https://github.com/r1az4r/CVE-2006-20001"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-01-17","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2006-20001","provenance":"source"},{"date":"2023-02-07","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/r1az4r/CVE-2006-20001","provenance":"source"}],"speed":{"daysToPublicExploit":21,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":27.4,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":17.87,"detail":"percentile 0.8937"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}