CVE-2009-1890: apache http_server Uncontrolled Resource Consumption
Vulnerability summary
CVE-2009-1890 is a high (CVSS 7.1) Uncontrolled Resource Consumption vulnerability in apache http_server. EPSS estimates a 16.16% chance of exploitation in the next 30 days, higher than 96.9% of scored vulnerabilities.
Not severe (CVSS 7.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 1Timeline
- 05-07-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
16.16%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
No change 0.00 pp
From 16.16% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Redhat5 products
Debian2 products
- apache2< 2.2.11-7
- debian_linuxEOL4.0 | 5.0 | 6.0
Apache1 product
- http_server≥ 2.2.0, < 2.2.12
Canonical1 product
- ubuntu_linuxEOL6.06 | 8.04 | 8.10 | 9.04
Fedoraproject1 product
- fedoraEOL11
5 vendors · 10 products
References
51 links- www.redhat.com/archives/fedora-package-announce/2009-August/msg01363.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- www-01.ibm.com/support/docview.wss?uid=swg1PK99480Vendor AdvisoryX Refsource AIXAPARThird Party Advisory
- www-01.ibm.com/support/docview.wss?uid=swg1PK91259Vendor AdvisoryX Refsource AIXAPARThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12330VDB EntrySignatureX Refsource OVALThird Party Advisory
- www.mandriva.com/security/advisories?name=MDVSA-2009:149Vendor AdvisoryX Refsource MANDRIVABroken Link
- www.redhat.com/support/errata/RHSA-2009-1156.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
Show all 51 references
- www.securityfocus.com/archive/1/507852/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
- www.securityfocus.com/archive/1/507857/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
- marc.info?l=bugtraq&m=129190899612998&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
- www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.htmlX Refsource CONFIRMThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9403VDB EntrySignatureX Refsource OVALThird Party Advisory
- svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=790587&r2=790586&pathrev=790587X Refsource CONFIRMPatchVendor Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8616VDB EntrySignatureX Refsource OVALThird Party Advisory
- www.vupen.com/english/advisories/2009/3184VDB EntryX Refsource VUPENPermissions RequiredVendor Advisory
- lists.apple.com/archives/security-announce/2009/Nov/msg00000.htmlVendor AdvisoryX Refsource APPLEBroken LinkMailing List
- www.mandriva.com/security/advisories?name=MDVSA-2013:150Vendor AdvisoryX Refsource MANDRIVABroken Link
