CVE-2003-0016

Apache before 2.0.44, when running on unpatched Windows 9x and Me operating systems, allows remote attackers to cause a denial of service or execute arbitrary code via an HTTP request containing MS-DOS device names.

Published: 2003-02-07 Last update: 2026-04-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2003-0016 is rated Moderate Risk (58.8/100): CVSS High severity, with high exploitation likelihood (EPSS 16.01%, 96th percentile). EPSS ranks this CVE among the most likely to be exploited in the near term. High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2003-0016

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 46.18% 16.01% -30.18%
2 2026-05-07 45.03% 46.18% +1.15%
3 2025-12-28 — 45.03% —

Full EPSS history (14 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2003-0016

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.5 2.0 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:P)
Partial availability impact.
 10.0 6.4 [email protected]

Weakness enumeration for CVE-2003-0016

Vendor comments (NVD) for CVE-2003-0016

  • Apache (2008-07-02T00:00:00)

    Fixed in Apache HTTP Server 2.0.44: http://httpd.apache.org/security/vulnerabilities_20.html

Affected software / configurations for CVE-2003-0016

Vendor Product Version Raw CPE
apache http_server 2.0.36 cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*
apache http_server 2.0.37 cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*
apache http_server 2.0.38 cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*
apache http_server 2.0.39 cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*
apache http_server 2.0.40 cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*
apache http_server 2.0.41 cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*
apache http_server 2.0.42 cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*
apache http_server 2.0.43 cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:*

References for CVE-2003-0016

URL Tags
http://marc.info/?l=apache-httpd-announce&m=104313442901017&w=2
http://www.apacheweek.com/issues/03-01-24#security
http://www.kb.cert.org/vuls/id/825177 US Government Resource
http://www.kb.cert.org/vuls/id/979793 US Government Resource
http://www.securityfocus.com/bid/6659
https://exchange.xforce.ibmcloud.com/vulnerabilities/11124
https://exchange.xforce.ibmcloud.com/vulnerabilities/11125
https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7035b7c9091c4b665a3b7205364775410646f12125d48e74e395f2ce%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rd00b45b93fda4a5bd013b28587207d0e00f99f6e3308dbb6025f3b01%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re028d61fe612b0908595d658b9b39e74bca56f2a1ed3c5f06b5ab571%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
cvelogic Threat Intelligence