{"schemaVersion":3,"id":"CVE-2009-2699","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.","dates":{"published":"2009-10-13T10:00:00.000Z","modified":"2024-08-07T05:59:56.883Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5,"severity":"medium","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.14173,"percentile":0.96572,"severity":"medium","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.14173},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.14173,"percentile":0.96572}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.14173,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.14173,"percentile":0.96572}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-667","name":"Improper Locking","description":"The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/667.html"}],"affected":[{"vendor":"apache","product":"http_server","name":"HTTP Server","label":"http_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.2.0, < 2.2.14","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.2.0, < 2.2.14","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"apache-http-server","label":"Apache HTTP Server","category":"server-app"}},"hubHref":"/vendor/apache/http_server"},{"vendor":"apache","product":"portable_runtime","name":"portable runtime","label":"portable_runtime","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.3.9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.9","eol":null,"hubHref":"/vendor/apache/portable_runtime"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.apache.org/dist/httpd/CHANGES_2.2.14","label":"www.apache.org/dist/httpd/CHANGES_2.2.14","hostname":"www.apache.org","tags":["X Refsource CONFIRM","Broken Link","Vendor Advisory"]},{"url":"http://securitytracker.com/id?1022988","label":"securitytracker.com/id?1022988","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"http://marc.info/?l=bugtraq&m=133355494609819&w=2","label":"marc.info?l=bugtraq&m=133355494609819&w=2","hostname":"marc.info","tags":["Vendor Advisory","X Refsource HP","Issue Tracking","Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/36596","label":"www.securityfocus.com/bid/36596","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Patch","Third Party Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/53666","label":"exchange.xforce.ibmcloud.com/vulnerabilities/53666","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF","Third Party Advisory"]},{"url":"https://issues.apache.org/bugzilla/show_bug.cgi?id=47645","label":"issues.apache.org/bugzilla/show_bug.cgi?id=47645","hostname":"issues.apache.org","tags":["X Refsource CONFIRM","Issue Tracking","Vendor Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html","label":"www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html","hostname":"www.oracle.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150","label":"www.mandriva.com/security/advisories?name=MDVSA-2013:150","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA","Broken Link"]},{"url":"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST","Patch"]},{"url":"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST","Patch"]},{"url":"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST","Patch"]},{"url":"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST","Patch"]},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST","Patch"]},{"url":"https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST","Patch"]},{"url":"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST","Patch"]},{"url":"https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST","Patch"]},{"url":"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST","Patch"]},{"url":"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST","Patch"]},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST","Patch"]},{"url":"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST","Patch"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2024:10268-1","SUSE-SU-2017:2907-1"],"duplicates":[],"related":["OPENSUSE-SU-2024:10268-1","SUSE-SU-2017:2907-1"]},"timeline":[{"kind":"published","date":"2009-10-13T10:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T05:59:56.883Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":33,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T17:38:16.769Z","stale":false,"partial":false}}