CveMateVulnerability intelligence

CVE-2011-0419: apache http_server

Modified

AliasesRHSA-2011:0507DEBIAN-CVE-2011-0419

Published 16-05-2011Last modified 06-08-2024

Vulnerability summary

CVE-2011-0419 is a medium (CVSS 4.3) vulnerability in apache http_server. EPSS estimates a 30.41% chance of exploitation in the next 30 days, higher than 98.2% of scored vulnerabilities. 3 public exploits are recorded.

Priority

Routine

Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

30.41%

0%100%

High · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits3reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 4 · Related 2

DSA-2237-2 OPENSUSE-SU-2024:10063-1 OPENSUSE-SU-2024:11596-1 RHSA-2011:0897

Timeline

16-05-2011
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

30.41%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

No change 0.00 pp

From 30.41% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

3 found

referenceUnverified
Exploit Reference (securityreason.com)
Maturity: unknown
referenceUnverified
Exploit Reference (securityreason.com)
Maturity: unknown
exploit-databasedoslinuxVerified
Apache 1.4/2.2.x - APR 'apr_fnmatch()' Denial of Service
Maturity: poc

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat4 products

apr< 0:0.9.4-25.el4 | < 0:1.2.7-11.el5_6.4 | < 0:1.3.9-3.el6_0.1
apr-debuginfo< 0:0.9.4-25.el4 | < 0:1.2.7-11.el5_6.4 | < 0:1.3.9-3.el6_0.1
apr-devel< 0:0.9.4-25.el4 | < 0:1.2.7-11.el5_6.4 | < 0:1.3.9-3.el6_0.1
apr-docs< 0:1.2.7-11.el5_6.4

Apache2 products

http_server≥ 2.0.0, ≤ 2.0.65 | ≥ 2.2.0, ≤ 2.2.18
portable_runtime< 1.4.3

Debian2 products

apr< 1.4.4-1
debian_linuxEOL5.0 | 6.0 | 7.0

Apple1 product

mac_os_x10.6.0

Netbsd1 product

netbsdEOL5.1

Openbsd1 product

openbsdEOL4.8

Oracle1 product

solarisEOL10

Suse1 product

linux_enterprise_server10:sp3

8 vendors · 13 products

References

65 links

secunia.com/advisories/44574Third Party AdvisoryX Refsource SECUNIANot ApplicableVendor Advisory
marc.info?l=bugtraq&m=131731002122529&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
marc.info?l=bugtraq&m=134987041210674&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
www.mail-archive.com/dev%40apr.apache.org/msg23976.htmlMailing ListX Refsource MLISTThird Party Advisory
secunia.com/advisories/48308Third Party AdvisoryX Refsource SECUNIANot Applicable
securityreason.com/achievement_securityalert/98Third Party AdvisoryX Refsource SREASONRESExploit
marc.info?l=bugtraq&m=131551295528105&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
marc.info?l=bugtraq&m=132033751509019&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14804VDB EntrySignatureX Refsource OVALThird Party Advisory
www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.htmlX Refsource CONFIRMThird Party Advisory

Show all 65 references

cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/fnmatch.cX Refsource CONFIRMThird Party Advisory
cxib.net/stuff/apr_fnmatch.txtsX Refsource MISCThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14638VDB EntrySignatureX Refsource OVALThird Party Advisory
securitytracker.com/id?1025527VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
svn.apache.org/viewvc?view=revision&revision=1098188X Refsource CONFIRMPatchVendor Advisory
www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gen/fnmatch.cX Refsource CONFIRMBroken Link
www.apache.org/dist/apr/CHANGES-APR-1.4X Refsource CONFIRMBroken Link
www.apache.org/dist/apr/Announcement1.x.htmlX Refsource CONFIRMPatchVendor Advisory
svn.apache.org/viewvc?view=revision&revision=1098799X Refsource CONFIRMPatchVendor Advisory
lists.apple.com/archives/Security-announce/2011//Oct/msg00003.htmlVendor AdvisoryX Refsource APPLEBroken Link
httpd.apache.org/security/vulnerabilities_22.htmlX Refsource CONFIRMVendor Advisory
svn.apache.org/viewvc/apr/apr/branches/1.4.x/strings/apr_fnmatch.c?r1=731029&r2=1098902X Refsource CONFIRMPatchVendor Advisory
securityreason.com/securityalert/8246Third Party AdvisoryX Refsource SREASONExploit
www.debian.org/security/2011/dsa-2237Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.redhat.com/support/errata/RHSA-2011-0897.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=703390X Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryREPORT
secunia.com/advisories/44564Third Party AdvisoryX Refsource SECUNIANot ApplicableVendor Advisory
www.apache.org/dist/httpd/Announcement2.2.htmlX Refsource CONFIRMPatchVendor Advisory
www.oracle.com/technetwork/topics/security/cpujul2012-392727.htmlX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/44490Third Party AdvisoryX Refsource SECUNIANot ApplicableVendor Advisory
cxib.net/stuff/apache.fnmatch.phpsX Refsource MISCPatchThird Party Advisory
www.redhat.com/support/errata/RHSA-2011-0896.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
support.apple.com/kb/HT5002X Refsource CONFIRMThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2011:084Vendor AdvisoryX Refsource MANDRIVABroken Link
www.mail-archive.com/dev%40apr.apache.org/msg23961.htmlMailing ListX Refsource MLISTThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2013:150Vendor AdvisoryX Refsource MANDRIVABroken Link
www.redhat.com/support/errata/RHSA-2011-0507.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.mail-archive.com/dev%40apr.apache.org/msg23960.htmlMailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party AdvisoryVDB Entry
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
access.redhat.com/errata/RHSA-2011:0507Advisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0507.jsonAdvisory
access.redhat.com/security/cve/CVE-2011-0419REPORT
www.cve.org/CVERecord?id=CVE-2011-0419Advisory
nvd.nist.gov/vuln/detail/CVE-2011-0419Advisory
security-tracker.debian.org/tracker/CVE-2011-0419Advisory