The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to Apache HTTPD version 2.2.22Upgrade to Apache HTTPD version 2.0.65 | Jul 18, 2019 | Nov 8, 2011 |
| Debian | — | Upgrade apache2 | Jul 30, 2024 | Nov 8, 2011 |
| Hpsmh | — | Upgrade to the latest version of HP System Management Homepage | Oct 13, 2015 | Nov 8, 2011 |
| Ibm Http_server | — | Apply IBM HTTP Server version 8.0.0.3 or later | Jul 18, 2019 | Nov 8, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 2, 2011 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub