CVE-2009-1891: apache http_server Uncontrolled Resource Consumption
Vulnerability summary
CVE-2009-1891 is a high (CVSS 7.1) Uncontrolled Resource Consumption vulnerability in apache http_server. EPSS estimates a 17.11% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities. 2 public exploits are recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 9 · Related 1Timeline
- 10-07-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
17.11%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
No change 0.00 pp
From 17.11% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (marc.info)
Maturity: unknown
Exploit Reference (bugs.debian.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Redhat5 products
Debian2 products
- apache2< 2.2.11-7
- debian_linuxEOL4.0 | 5.0 | 6.0
Apache1 product
- http_server≥ 2.0.35, < 2.0.64 | ≥ 2.2.0, < 2.2.12
Canonical1 product
- ubuntu_linuxEOL6.06 | 8.04 | 8.10 | 9.04
Fedoraproject1 product
- fedoraEOL11
5 vendors · 10 products
References
56 links- marc.info?l=apache-httpd-dev&m=124621326524824&w=2Mailing ListX Refsource MLISTExploitIssue TrackingThird Party Advisory
- www.redhat.com/archives/fedora-package-announce/2009-August/msg01363.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- www-01.ibm.com/support/docview.wss?uid=swg1PK99480Vendor AdvisoryX Refsource AIXAPARThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12361VDB EntrySignatureX Refsource OVALThird Party Advisory
- www.mandriva.com/security/advisories?name=MDVSA-2009:149Vendor AdvisoryX Refsource MANDRIVABroken LinkPatch
- www-01.ibm.com/support/docview.wss?uid=swg1PK91361Vendor AdvisoryX Refsource AIXAPARThird Party Advisory
- marc.info?l=bugtraq&m=130497311408250&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
Show all 56 references
- www.redhat.com/support/errata/RHSA-2009-1156.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
- www.vupen.com/english/advisories/2009/1841VDB EntryX Refsource VUPENPermissions RequiredVendor Advisory
- marc.info?l=apache-httpd-dev&m=124661528519546&w=2Mailing ListX Refsource MLISTIssue TrackingThird Party Advisory
- www.securityfocus.com/archive/1/507857/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8632VDB EntrySignatureX Refsource OVALThird Party Advisory
- marc.info?l=bugtraq&m=129190899612998&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9248VDB EntrySignatureX Refsource OVALThird Party Advisory
- www.vupen.com/english/advisories/2009/3184VDB EntryX Refsource VUPENPermissions RequiredVendor Advisory
- bugzilla.redhat.com/show_bug.cgi?id=509125X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
- lists.apple.com/archives/security-announce/2009/Nov/msg00000.htmlVendor AdvisoryX Refsource APPLEBroken LinkMailing List