PT-2009-4353 · Apache+1 · Apache Httpd+2
Published
2009-06-26
·
Updated
2024-06-15
·
CVE-2009-1891
CVSS v2.0
7.1
High
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
Apache httpd versions 2.2.11 and earlier
Description:
A denial of service issue exists due to the mod deflate module continuing to compress large files until completion, even after the associated network connection is closed. This allows remote attackers to cause a denial of service by consuming large amounts of CPU. The issue is triggered when mod deflate is enabled for a large file and the network connection that requested the content is closed before compression is complete.
Recommendations:
For Apache httpd versions 2.2.11 and earlier, consider disabling the mod deflate module as a temporary workaround to prevent CPU consumption denial of service attacks.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Http Server
Apache Httpd
Red Hat