LOW
httpd: mod_negotiation CRLF injection via untrusted file names in directories with MultiViews enabled
Published Jan 25, 2008
2.6
LOWCVSS 2.0
EPSS 19.04%
Description
CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
Affected products
No data.
Configuration 1
- ≥ 2.2.0 · < 2.2.12
Configuration 2
OR
- 5.0
- 5.0
- 5.0
No data.
Red Hat Enterprise Linux 5
httpd-0:2.2.3-74.el5
Fixed · RHSA-2013:0130
Red Hat Enterprise Linux 6
httpd
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 5 | httpd-0:2.2.3-74.el5 | Fixed | RHSA-2013:0130 |
| Red Hat Enterprise Linux 6 | httpd | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
2.6 LOW NVD
AV:N/AC:H/Au:N/C:N/I:P/A:N
Access Vector Network
Access Complexity High
Authentication None
Confidentiality Impact None
Integrity Impact Partial
Availability Impact None
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
19.04% 0.19036
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.19036
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (45 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 19.04% (0.19036) | 97.23th | v5 (v2026.06.15) |
| Jun 15, 2026 | 19.04% (0.19036) | 96.94th | v5 (v2026.06.15) |
| Jun 11, 2026 | 15.46% (0.15455) | 94.81th | v4 (v2025.03.14) |
| Jun 7, 2026 | 12.49% (0.12490) | 94.06th | v4 (v2025.03.14) |
| Mar 4, 2026 | 7.20% (0.07199) | 91.43th | v4 (v2025.03.14) |
| Mar 1, 2026 | 3.60% (0.03599) | 87.59th | v4 (v2025.03.14) |
| Feb 4, 2026 | 7.58% (0.07575) | 91.61th | v4 (v2025.03.14) |
| Feb 1, 2026 | 2.95% (0.02951) | 86.16th | v4 (v2025.03.14) |
| Jan 4, 2026 | 7.58% (0.07575) | 91.55th | v4 (v2025.03.14) |
| Jan 1, 2026 | 2.95% (0.02951) | 86.10th | v4 (v2025.03.14) |
| Dec 28, 2025 | 7.58% (0.07575) | 91.52th | v4 (v2025.03.14) |
| Dec 27, 2025 | 5.16% (0.05156) | 89.58th | v4 (v2025.03.14) |
| Dec 4, 2025 | 7.58% (0.07575) | 91.47th | v4 (v2025.03.14) |
| Dec 1, 2025 | 3.79% (0.03794) | 87.72th | v4 (v2025.03.14) |
| Nov 4, 2025 | 7.58% (0.07575) | 91.41th | v4 (v2025.03.14) |
| Nov 1, 2025 | 3.79% (0.03794) | 87.64th | v4 (v2025.03.14) |
| Oct 28, 2025 | 7.58% (0.07575) | 91.41th | v4 (v2025.03.14) |
| Oct 27, 2025 | 5.16% (0.05156) | 89.43th | v4 (v2025.03.14) |
| Oct 4, 2025 | 7.58% (0.07575) | 91.46th | v4 (v2025.03.14) |
| Oct 1, 2025 | 3.79% (0.03794) | 87.66th | v4 (v2025.03.14) |
| Sep 25, 2025 | 5.99% (0.05994) | 90.33th | v4 (v2025.03.14) |
| Sep 22, 2025 | 8.71% (0.08706) | 92.15th | v4 (v2025.03.14) |
| Sep 6, 2025 | 14.34% (0.14344) | 94.17th | v4 (v2025.03.14) |
| Sep 1, 2025 | 6.61% (0.06610) | 90.87th | v4 (v2025.03.14) |
| Aug 4, 2025 | 14.34% (0.14344) | 94.12th | v4 (v2025.03.14) |
| Aug 1, 2025 | 6.61% (0.06610) | 90.86th | v4 (v2025.03.14) |
| Jul 30, 2025 | 14.34% (0.14344) | 94.12th | v4 (v2025.03.14) |
| Jul 15, 2025 | 17.84% (0.17838) | 94.82th | v4 (v2025.03.14) |
| Jul 4, 2025 | 21.69% (0.21689) | 95.45th | v4 (v2025.03.14) |
| Jul 1, 2025 | 9.61% (0.09614) | 92.54th | v4 (v2025.03.14) |
| Jun 4, 2025 | 21.69% (0.21689) | 95.40th | v4 (v2025.03.14) |
| Jun 1, 2025 | 9.61% (0.09614) | 92.50th | v4 (v2025.03.14) |
| May 15, 2025 | 21.69% (0.21689) | 95.38th | v4 (v2025.03.14) |
| May 4, 2025 | 26.92% (0.26921) | 96.04th | v4 (v2025.03.14) |
| May 1, 2025 | 9.61% (0.09614) | 92.47th | v4 (v2025.03.14) |
| Apr 12, 2025 | 26.92% (0.26921) | 95.95th | v4 (v2025.03.14) |
| Mar 17, 2025 | 22.62% (0.22621) | 95.40th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.58% (0.00583) | 78.87th | v3 (v2023.03.01) |
| Jun 28, 2024 | 0.96% (0.00962) | 83.39th | v3 (v2023.03.01) |
| Apr 10, 2024 | 0.68% (0.00682) | 79.70th | v3 (v2023.03.01) |
| Nov 8, 2023 | 0.68% (0.00682) | 77.69th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.54% (0.00536) | 73.63th | v3 (v2023.03.01) |
| Mar 6, 2023 | 7.34% (0.07344) | 92.59th | v2 (v2022.01.01) |
| Apr 1, 2022 | 7.34% (0.07344) | 91.87th | v2 (v2022.01.01) |
| Feb 4, 2022 | 7.34% (0.07344) | 80.64th | v2 (v2022.01.01) |
Weaknesses (1)
References (30)
- http://lists.apple.com/archives/security-announce/2009/May/msg00002.html vendor-advisoryx_refsource_APPLEBroken LinkMailing ListThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0130.html vendor-advisoryx_refsource_REDHATThird Party Advisory
- http://secunia.com/advisories/29348 third-party-advisoryx_refsource_SECUNIANot ApplicableThird Party Advisory
- http://secunia.com/advisories/35074 third-party-advisoryx_refsource_SECUNIANot ApplicableThird Party Advisory
- http://security.gentoo.org/glsa/glsa-200803-19.xml vendor-advisoryx_refsource_GENTOOThird Party Advisory
- http://securityreason.com/securityalert/3575 third-party-advisoryx_refsource_SREASONExploitThird Party Advisory
- http://securitytracker.com/id?1019256 vdb-entryx_refsource_SECTRACKBroken LinkThird Party AdvisoryVDB Entry
- http://support.apple.com/kb/HT3549 x_refsource_CONFIRMThird Party Advisory
- http://www.mindedsecurity.com/MSA01150108.html x_refsource_MISCBroken Link
- http://www.securityfocus.com/archive/1/486847/100/0/threaded mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/27409 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- http://www.us-cert.gov/cas/techalerts/TA09-133A.html third-party-advisoryx_refsource_CERTThird Party AdvisoryUS Government Resource
- http://www.vupen.com/english/advisories/2009/1297 vdb-entryx_refsource_VUPENPermissions RequiredThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2008-0456 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=879292 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39893 vdb-entryx_refsource_XFThird Party AdvisoryVDB Entry
- https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLIST
- https://nvd.nist.gov/vuln/detail/CVE-2008-0456
- https://www.cve.org/CVERecord?id=CVE-2008-0456
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jan 25, 2008
Updated Aug 7, 2024
Reserved Jan 24, 2008
Link CVE-2008-0456
CISA Vulnrichment
Updated n/a