Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
Conclusion & alert: CVE-2006-3747 is rated High Exploit Risk (85.4/100): CVSS High severity, with high exploitation likelihood (EPSS 95.65%, 100th percentile). Core evidence: 4 public exploit reference(s) are indexed (Exploit-DB). EPSS rose +5.62% over the last day, indicating growing attacker interest. Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| 16752 | exploit_db | edb | 2010-02-15 | Exploit-DB ↗ |
| 3996 | exploit_db | edb | 2007-05-26 | Exploit-DB ↗ |
| 3680 | exploit_db | edb | 2007-04-07 | Exploit-DB ↗ |
| 2237 | exploit_db | edb | 2006-08-21 | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 90.02% | 95.65% | +5.62% |
| 2 | 2026-04-25 | 92.61% | 90.02% | -2.58% |
| 3 | 2026-03-13 | — | 92.61% | — |
Full EPSS history (47 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.6 | 2.0 | HIGH |
|
4.9 | 10.0 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
medium | CVE-2006-3747 medium priority: Debian including 1 source packages (apache2), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2006-3747 |
gentoo
|
high | CVE-2006-3747: 1 GLSA(s) (200608-01), 1 atom(s) (www-servers/apache); latest impact high. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2006-3747 |
redhat
|
— | — | https://access.redhat.com/security/cve/CVE-2006-3747 |
suse
|
high | CVE-2006-3747 severity important: SUSE including 33 source package names (apache2-2.2.10-2.24.5, apache2-2.2.12-1.28.1, …), 39 product×package rows across 7 product lines (SUSE Linux Enterprise Server 11 SP1, SUSE Linux Enterprise Server 11 SP2, … (7 product lines)): Fixed 39. | https://www.suse.com/security/cve/CVE-2006-3747/ |
ubuntu
|
medium | CVE-2006-3747 medium priority: Ubuntu including 2 source packages (apache, apache2), 8 status rows across 4 suites (dapper, edgy, feisty, upstream): released 6, needs-triage 2. | https://ubuntu.com/security/CVE-2006-3747 |
The ability to exploit this issue is dependent on the stack layout for a particular compiled version of mod_rewrite. If the compiler has added padding to the stack immediately after the buffer being overwritten, this issue can not be exploited, and Apache httpd will continue operating normally. The Red Hat Security Response Team analyzed Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4 binaries for all architectures as shipped by Red Hat and determined that these versions cannot be exploited. This issue does not affect the version of Apache httpd as supplied with Red Hat Enterprise Linux 2.1
Fixed in Apache HTTP Server 2.2.3, 2.0.59, and 1.3.37: http://httpd.apache.org/security/vulnerabilities_22.html http://httpd.apache.org/security/vulnerabilities_20.html http://httpd.apache.org/security/vulnerabilities_13.html
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| apache | http_server | >= 1.3.28, < 1.3.37 | cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* |
| apache | http_server | >= 2.0.46, < 2.0.59 | cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* |
| apache | http_server | >= 2.2.0, < 2.2.3 | cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* |
| canonical | ubuntu_linux | 5.04 | cpe:2.3:o:canonical:ubuntu_linux:5.04:*:*:*:*:*:*:* |
| canonical | ubuntu_linux | 5.10 | cpe:2.3:o:canonical:ubuntu_linux:5.10:*:*:*:*:*:*:* |
| canonical | ubuntu_linux | 6.06 | cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:* |
| debian | debian_linux | 3.1 | cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:* |