Medium severity6.1NVD Advisory· Published Dec 10, 2019· Updated Jun 17, 2026

CVE-2016-1000108

Description

yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Yaws/Yaws2 versions
cpe:2.3:a:yaws:yaws:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:yaws:yaws:*:*:*:*:*:*:*:*range: <2.0.4
- (no CPE)range: <2.0.4
Debian/linux3 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
yaws/yawsdescription

Patches

Vulnerability mechanics

References

github.com/klacke/yaws/commit/9d8fb070e782c95821c90d0ca7372fc6d7316c78nvdPatchThird Party Advisory
www.openwall.com/lists/oss-security/2016/07/18/6nvdMailing ListThird Party Advisory
raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000108.jsonnvdThird Party Advisory
security-tracker.debian.org/tracker/CVE-2016-1000108nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000