PT-2009-4353 · Apache+1 · Apache Httpd+2

Published

2009-06-26

·

Updated

2024-06-15

·

CVE-2009-1891

CVSS v2.0

7.1

High

VectorAV:N/AC:M/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions: Apache httpd versions 2.2.11 and earlier
Description: A denial of service issue exists due to the mod deflate module continuing to compress large files until completion, even after the associated network connection is closed. This allows remote attackers to cause a denial of service by consuming large amounts of CPU. The issue is triggered when mod deflate is enabled for a large file and the network connection that requested the content is closed before compression is complete.
Recommendations: For Apache httpd versions 2.2.11 and earlier, consider disabling the mod deflate module as a temporary workaround to prevent CPU consumption denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2009-1891
DSA-1834-1
HPSBUX02612
OPENSUSE-SU-2024:10268-1
RHSA-2009:1148
RHSA-2009:1155
RHSA-2009:1156
RHSA-2009:1160
RHSA-2009:1205
RHSA-2009:1580
RHSA-2009_1148
RHSA-2009_1580
RHSA-2010:0602

Affected Products

Apache Http Server
Apache Httpd
Red Hat