7.8

CVE-2011-3192: apache http_server Uncontrolled Resource Consumption

Modified
AliasesRHSA-2011:1245RHSA-2011:1294RHSA-2011:1300
Published 29-08-2011Last modified 06-08-2024

Vulnerability summary

CVE-2011-3192 is a high (CVSS 7.8) Uncontrolled Resource Consumption vulnerability in apache http_server. EPSS estimates a 98.95% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 6 public exploits are recorded.

Priority
Prioritiseweaponized exploit

Weaponized exploit (Metasploit, 19-08-2011)

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v2.0 (NVD)
EPSS score
98.95%
0%100%
Critical · +0.12 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits6reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2024:10268-1

Timeline

  1. 29-08-2011
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

98.95%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

Increase +0.12 pp

From 98.83% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

6 found
  • referenceUnverified

    Exploit Reference (bugzilla.redhat.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (issues.apache.org)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (seclists.org)

    Maturity: unknown

Show all 6 exploits
  • exploit-databasedoslinuxUnverified

    Apache - Denial of Service

    Maturity: poc

  • exploit-databasedosmultipleUnverified

    Apache - Remote Memory Exhaustion (Denial of Service)

    Maturity: poc

  • MetasploitMetasploitremoteUnverified

    Apache Range Header DoS (Apache Killer)

    auxiliary/dos/http/apache_range_dos

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat16 products
  • httpd< 0:2.0.52-48.ent | < 0:2.2.3-53.el5_7.1 | < 0:2.2.15-9.el6_1.2 | < 0:2.2.3-22.el5_3.3 | < 0:2.2.3-45.el5_6.2 | < 0:2.2.15-5.el6_0.1 | < 0:2.0.46-78.ent | < 0:2.2.17-14.1.ep5.el5 | < 0:2.2.17-13.2.ep5.el6 | < 0:2.2.13-3.el5s2
  • httpd-debuginfo< 0:2.0.52-48.ent | < 0:2.2.3-53.el5_7.1 | < 0:2.2.15-9.el6_1.2 | < 0:2.2.3-22.el5_3.3 | < 0:2.2.3-45.el5_6.2 | < 0:2.2.15-5.el6_0.1 | < 0:2.0.46-78.ent | < 0:2.2.13-3.el5s2
  • httpd-devel< 0:2.0.52-48.ent | < 0:2.2.3-53.el5_7.1 | < 0:2.2.15-9.el6_1.2 | < 0:2.2.3-22.el5_3.3 | < 0:2.2.3-45.el5_6.2 | < 0:2.2.15-5.el6_0.1 | < 0:2.0.46-78.ent | < 0:2.2.17-14.1.ep5.el5 | < 0:2.2.17-13.2.ep5.el6 | < 0:2.2.13-3.el5s2
  • httpd-manual< 0:2.0.52-48.ent | < 0:2.2.3-53.el5_7.1 | < 0:2.2.15-9.el6_1.2 | < 0:2.2.3-22.el5_3.3 | < 0:2.2.3-45.el5_6.2 | < 0:2.2.15-5.el6_0.1 | < 0:2.2.17-14.1.ep5.el5 | < 0:2.2.17-13.2.ep5.el6 | < 0:2.2.13-3.el5s2
  • httpd-suexec< 0:2.0.52-48.ent
Suse2 products
Apache1 product
Canonical1 product
Debian1 product
  • apache2< 2.2.9-10+lenny10 | < 2.2.16-6+squeeze2 | < 2.2.19-2
Opensuse1 product

6 vendors · 22 products

References

87 links
Show all 87 references