IsItPatchedInstant security status for any software version
← All products

CVE-2006-3918

MEDIUM severity · CVSS 4.3 · Cross-site scripting (XSS)
4.3CVSS MEDIUM

Summary

http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

Impact & exploitability

Attack vectorNetwork
Attack complexity—
Privileges required—
User interaction—
Confidentiality impactNone
Integrity impact—
Availability impactNone
Exploit probability (EPSS)91%

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products we track (3)

Apache HTTP ServerUbuntuDebian

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

Last checked: Wed, 10 Jun 2026 22:18:30 UTC