CVE-2006-3918

76

FAUCET Score

CVE-2006-3918 describes a cross-site scripting (XSS) vulnerability in IBM HTTP Server and Apache HTTP Server versions prior to 6.0.2.13/6.1.0.1 and 1.3.35/2.0.58/2.2.2 respectively. The flaw arises from improper sanitization of the 'Expect' HTTP header when reflected in error messages, allowing attackers to inject malicious scripts. This vulnerability has a CVSS score of 4.3, indicating a medium severity, and can be exploited remotely with medium attack complexity, potentially leading to information disclosure or client-side attacks. While not listed in CISA's KEV catalog, there is public exploit code available on ExploitDB, though there is no evidence of active exploitation or significant community discussion.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 1.3.3, < 1.3.35CPE matchmatch criteria	cpe:2.3:a:apache:http_server::::::::
		3.1CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:3.1:::::::*
		6.06CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:6.06:::::::*
		6.10CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:6.10:::::::*
		7.04CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:7.04:::::::*

CVSS Data

CVSS version used by this source: 2.0

4.3MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Exploitability Score

8.6

Impact Score

2.9

CvssVersion

2.0

Exploit Intelligence

EPSS Score

94.93%

Probability of exploitation in next 30 days

EPSS Percentile

99.9%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

ExploitDB: EDB-28424 · Aug 24, 2006

This CVE's current EPSS score of 0.9493 is in the 100th percentile among its peer group of 19,958 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (33)

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: ant-0:1.6.5-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: avalon-logkit-0:1.2-2jpp_4rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: axis-0:1.2.1-1jpp_3rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: classpathx-jaf-0:1.0-2jpp_6rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: classpathx-mail-0:1.1.1-2jpp_8rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: geronimo-specs-0:1.0-0.M4.1jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: jakarta-commons-modeler-0:2.0-3jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: log4j-0:1.2.12-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: mx4j-1:3.0.1-1jpp_4rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: pcsc-lite-0:1.3.3-3.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-ca-0:7.3.0-20.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-java-tools-0:7.3.0-10.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-kra-0:7.3.0-14.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-manage-0:7.3.0-19.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-native-tools-0:7.3.0-6.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-ocsp-0:7.3.0-13.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-tks-0:7.3.0-13.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: tomcat5-0:5.5.23-0jpp_4rh.16

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: xerces-j2-0:2.7.1-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: xml-commons-0:1.3.02-2jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 3Fixed in: httpd-0:2.0.46-61.ent

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 4Fixed in: httpd-0:2.0.52-28.ent

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux AS (Advanced Server) version 2.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux ES version 2.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux WS version 2.1

redhatpatch availablevia redhat_api

Product: Red Hat Linux Advanced Workstation 2.1

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 3)Fixed in: jabberd-0:2.0s10-3.37.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 3)Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 3)Fixed in: rhn-modperl-0:1.29-16.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 4)Fixed in: jabberd-0:2.0s10-3.38.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 4)Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Proxy v 4.2 (RHEL 4)Fixed in: rhn-modperl-0:1.29-16.rhel4

redhatpatch availablevia redhat_api

Product: Stronghold 4.0 for Red Hat Enterprise Linux AS (version 2.1)

Vendor Advisories (1)

redhatCVE-2006-3918Moderate

httpd: Expect header XSS

References

patches.sgi.com / support/free/security/advisories/20060801-01-P

Broken Link

archives.neohapsis.com / archives/bugtraq/2006-05/0151.html

Broken LinkExploit

archives.neohapsis.com / archives/bugtraq/2006-07/0425.html

Broken LinkExploit

kb.vmware.com / KanisaPlatform/Publishing/466/5915871_f.SAL_Public.html

Third Party Advisory

lists.opensuse.org / opensuse-security-announce/2008-04/msg00004.html

Mailing ListThird Party Advisory

Issue TrackingMailing ListThird Party Advisory

Issue TrackingMailing ListThird Party Advisory

Issue TrackingMailing ListThird Party Advisory

openbsd.org / errata.html

Third Party Advisory

rhn.redhat.com / errata/RHSA-2006-0618.html

Third Party Advisory

rhn.redhat.com / errata/RHSA-2006-0692.html

Third Party Advisory

secunia.com / advisories/21172

Not ApplicablePatchVendor Advisory

secunia.com / advisories/21174

Not ApplicablePatchVendor Advisory

secunia.com / advisories/21399

Not Applicable

secunia.com / advisories/21478

Not Applicable

secunia.com / advisories/21598

Not Applicable

secunia.com / advisories/21744

Not Applicable

secunia.com / advisories/21848

Not Applicable

secunia.com / advisories/21986

Not Applicable

secunia.com / advisories/22140

Not Applicable

secunia.com / advisories/22317

Not Applicable

secunia.com / advisories/22523

Not Applicable

secunia.com / advisories/28749

Not Applicable

secunia.com / advisories/29640

Not Applicable

secunia.com / advisories/40256

Not Applicable

securityreason.com / securityalert/1294

ExploitThird Party Advisory

securitytracker.com / id

Broken LinkThird Party AdvisoryVDB Entry

lists.apache.org / thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10352

Third Party Advisory

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12238

Third Party Advisory

support.avaya.com / elmodocs2/security/ASA-2006-194.htm

Third Party Advisory

svn.apache.org / viewvc

ExploitVendor Advisory

www14.software.ibm.com / webapp/set2/subscriptions/pqvcmjd

Broken Link

www-1.ibm.com / support/docview.wss

Third Party Advisory

www-1.ibm.com / support/docview.wss

Third Party Advisory

debian.org / security/2006/dsa-1167

Third Party Advisory

f-secure.com / en_EMEA/support/security-advisory/fsc-2010-2.html

Third Party Advisory

novell.com / linux/security/advisories/2006_51_apache.html

Third Party Advisory

redhat.com / support/errata/RHSA-2006-0619.html

Third Party Advisory

securityfocus.com / bid/19661

Third Party AdvisoryVDB Entry

securitytracker.com / id

Broken LinkThird Party AdvisoryVDB Entry

ubuntu.com / usn/usn-575-1

Third Party Advisory

vupen.com / english/advisories/2006/2963

Permissions Required

vupen.com / english/advisories/2006/2964

Permissions Required

vupen.com / english/advisories/2006/3264

Permissions Required

vupen.com / english/advisories/2006/4207

Permissions Required

vupen.com / english/advisories/2006/5089

Permissions Required

vupen.com / english/advisories/2010/1572

Permissions Required