CVE-2011-3348: apache http_server Uncontrolled Resource Consumption

EPSS trend

Probability

22.38%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

0.00 pp

From 22.38% on 18-09-2026

18-09-202618-10-2026

EPSS score

22.38%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (community.jboss.org)
Maturity: unknown

References

31 links

marc.info?l=bugtraq&m=131731002122529&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/69804VDB EntryX Refsource XFThird Party Advisory
support.apple.com/kb/HT5130X Refsource CONFIRMThird Party Advisory
www.redhat.com/support/errata/RHSA-2011-1391.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14941VDB EntrySignatureX Refsource OVALThird Party Advisory
rhn.redhat.com/errata/RHSA-2012-0543.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
marc.info?l=bugtraq&m=132033751509019&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.htmlX Refsource CONFIRMThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2011:168Vendor AdvisoryX Refsource MANDRIVABroken Link
lists.apple.com/archives/security-announce/2012/Feb/msg00000.htmlVendor AdvisoryX Refsource APPLEBroken LinkMailing List

Show all 31 references

community.jboss.org/message/625307X Refsource MISCExploitThird Party Advisory
www.securityfocus.com/bid/49616VDB EntryX Refsource BIDThird Party Advisory
rhn.redhat.com/errata/RHSA-2012-0542.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.apache.org/dist/httpd/Announcement2.2.htmlX Refsource CONFIRMBroken Link
httpd.apache.org/security/vulnerabilities_22.htmlX Refsource CONFIRMVendor Advisory
www.securitytracker.com/id?1026054VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18154VDB EntrySignatureX Refsource OVALThird Party Advisory
secunia.com/advisories/46013Third Party AdvisoryX Refsource SECUNIANot ApplicableVendor Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
security-tracker.debian.org/tracker/CVE-2011-3348Advisory

Related vulnerabilities

CVE-2018-1336apache software foundationapache tomcat+6820.35%8y ago02-08-2018 14:00An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.CVE-2018-1302apache software foundationapache http server+912.88%8y ago26-03-2018 15:00When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.CVE-2018-1333apache software foundationapache http server+1117.10%8y ago18-06-2018 18:00By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33).CVE-2018-1303apache software foundationapache http server+1069.80%8y ago26-03-2018 15:00A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.CVE-2018-1304apache software foundationapache tomcat+1317.07%8y ago28-02-2018 20:00The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.CVE-2018-1301apache software foundationapache http server+1114.99%8y ago26-03-2018 15:00A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage.

All vulnerabilities inhttp_server jboss_enterprise_web_server

CVE-2011-3348: apache http_server Uncontrolled Resource Consumption

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References