CVE-2012-0021

CVE-2012-0021 is a low-severity vulnerability in Apache Http Server with a CVSS 2.0 base score of 2.6. Its EPSS exploit-prediction score of 31% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-20.

Key facts

Description

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.

Frequently asked questions

What is CVE-2012-0021?
The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.
How severe is CVE-2012-0021?
CVE-2012-0021 has a CVSS 2.0 base score of 2.6, rated low severity.
Is CVE-2012-0021 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 31% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2012-0021?
CVE-2012-0021 primarily affects Apache Http Server. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2012-0021?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2012-0021 published?
CVE-2012-0021 was published on 2012-01-28 and last updated on 2026-06-16.

References

Affected products (5)

More vulnerabilities in Apache Http Server

All CVEs affecting Apache Http Server →

Other CWE-20 (Improper Input Validation) vulnerabilities

Browse all CWE-20 (Improper Input Validation) vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE: