Apache mod_remoteip NULL dereference (CVE-2019-10097)

Sep 09, 2026

Processing malformed headers with mod_remoteip crashes the Apache worker.

Vulnerability ID	Vulnerability Overview
CVE-2019-10097	When `mod_remoteip` is configured to use a trusted proxy string, an attacker can send a crafted header that triggers a NULL pointer dereference, causing a DoS.

Affected Supported TeraStations

TS5010/3020/3010
Fixed in firmware version 6.12

Date	Description
09/09/2026	Initial release