https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T13:36:13.992194+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2016-5387 CVE-2016-5387 2026-10-06T13:36:14.027066+00:00

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.

 https://cve.radiocsirt.org/vuln/usn-3038-1 USN-3038-1 — apache2 vulnerability 2026-10-06T13:36:14.027124+00:00

Affected: Ubuntu:14.04:LTS: apache2, Ubuntu:16.04:LTS: apache2

It was discovered that the Apache HTTP Server would set the HTTP_PROXY environment variable based on the contents of the Proxy header from HTTP requests. A remote attacker could possibly use this issue in combination with CGI scripts that honour the HTTP_PROXY variable to redirect outgoing HTTP requests.