CVE-2009-2699: apache http_server Improper Locking
Vulnerability summary
CVE-2009-2699 is a high (CVSS 7.5) Improper Locking vulnerability in apache http_server. EPSS estimates a 14.17% chance of exploitation in the next 30 days, higher than 96.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 13-10-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
14.17%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 14.17% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache2 products
- http_server≥ 2.2.0, < 2.2.14
- portable_runtime< 1.3.9
1 vendor · 2 products
References
20 links- marc.info?l=bugtraq&m=133355494609819&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
- www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.htmlX Refsource CONFIRMThird Party Advisory
- www.mandriva.com/security/advisories?name=MDVSA-2013:150Vendor AdvisoryX Refsource MANDRIVABroken Link