CVE-2015-7519: agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in

Q: How do I fix CVE-2015-7519?

phusion passenger: upgrade to newer than 4.0.59. Exact commands for each OS are on this page.

Q: Is CVE-2015-7519 being exploited?

CVE-2015-7519 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2015-7519 affect?

CVE-2015-7519 affects phusion passenger. Severity is low (CVSS 3.7). agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to appli

Q: How urgent is CVE-2015-7519?

Priority 39/100. Remotely exploitable, no login, no user action

Routine

LOW 3.7REMOTEUPGRADE

CVE-2015-7519 is a low-severity flaw (CVSS 3.7) affecting phusion passenger. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.

Why this priority

Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	3.7 (Low)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	None
User interaction	None
EPSS exploit chance	2.4% (top 16%)
CISA exploited list	No
Weakness	CWE-20
Published	2016-01-08
Last modified	2026-06-17

Publisher (CNA): Red Hat, Inc. · Vendor: phusionpassenger

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2016-01-08 19:59 UTCPublished CVE record published
2026-06-17 00:32 UTCUpdated Record last modified

phusionpassenger phusion passenger UPGRADE

Affected: <= 4.0.59 · 5.0.0 · 5.0.0 beta1 · 5.0.0 beta2 · 5.0.0 beta3 · 5.0.0 rc1 · 5.0.0 rc2 · 5.0.1

Fixed in: newer than 4.0.59

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy phusion-passenger || rpm -q phusion-passenger || phusion-passenger --version

2. UPGRADE to newer than 4.0.59 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade phusion-passenger

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade phusion-passenger

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2015-7519?

phusion passenger: upgrade to newer than 4.0.59. Exact commands for each OS are on this page.

Is CVE-2015-7519 being exploited?

CVE-2015-7519 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2015-7519 affect?

CVE-2015-7519 affects phusion passenger. Severity is low (CVSS 3.7). agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to appli

How urgent is CVE-2015-7519?

Priority 39/100. Remotely exploitable, no login, no user action

References

← Back to latest CVEs