The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.
Conclusion & alert: CVE-2002-0082 is rated High Exploit Risk (75.5/100): CVSS High severity, with medium exploitation likelihood (EPSS 2.70%). Core evidence: 3 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| 47080 | exploit_db | edb | 2019-07-07 | Exploit-DB ↗ |
| 764 | exploit_db | edb | 2003-04-04 | Exploit-DB ↗ |
| 21671 | exploit_db | edb | 2002-07-30 | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-09 | 2.33% | 2.70% | +0.37% |
| 2 | 2026-05-06 | 2.70% | 2.33% | -0.37% |
| 3 | 2026-05-02 | — | 2.70% | — |
Full EPSS history (17 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.5 | 2.0 | HIGH |
|
10.0 | 6.4 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2002-0082 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| apache-ssl | apache-ssl | 1.40 | cpe:2.3:a:apache-ssl:apache-ssl:1.40:*:*:*:*:*:*:* |
| apache-ssl | apache-ssl | 1.41 | cpe:2.3:a:apache-ssl:apache-ssl:1.41:*:*:*:*:*:*:* |
| apache-ssl | apache-ssl | 1.42 | cpe:2.3:a:apache-ssl:apache-ssl:1.42:*:*:*:*:*:*:* |
| apache-ssl | apache-ssl | 1.44 | cpe:2.3:a:apache-ssl:apache-ssl:1.44:*:*:*:*:*:*:* |
| apache-ssl | apache-ssl | 1.45 | cpe:2.3:a:apache-ssl:apache-ssl:1.45:*:*:*:*:*:*:* |
| apache-ssl | apache-ssl | 1.46 | cpe:2.3:a:apache-ssl:apache-ssl:1.46:*:*:*:*:*:*:* |
| mod_ssl | mod_ssl | 2.7.1 | cpe:2.3:a:mod_ssl:mod_ssl:2.7.1:*:*:*:*:*:*:* |
| mod_ssl | mod_ssl | 2.8 | cpe:2.3:a:mod_ssl:mod_ssl:2.8:*:*:*:*:*:*:* |
| mod_ssl | mod_ssl | 2.8.1 | cpe:2.3:a:mod_ssl:mod_ssl:2.8.1:*:*:*:*:*:*:* |
| mod_ssl | mod_ssl | 2.8.2 | cpe:2.3:a:mod_ssl:mod_ssl:2.8.2:*:*:*:*:*:*:* |
| mod_ssl | mod_ssl | 2.8.3 | cpe:2.3:a:mod_ssl:mod_ssl:2.8.3:*:*:*:*:*:*:* |
| mod_ssl | mod_ssl | 2.8.4 | cpe:2.3:a:mod_ssl:mod_ssl:2.8.4:*:*:*:*:*:*:* |
| mod_ssl | mod_ssl | 2.8.5 | cpe:2.3:a:mod_ssl:mod_ssl:2.8.5:*:*:*:*:*:*:* |
| mod_ssl | mod_ssl | 2.8.6 | cpe:2.3:a:mod_ssl:mod_ssl:2.8.6:*:*:*:*:*:*:* |