Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Apr 12, 2012 | Mar 29, 2004 |
| Debian | — | Upgrade apache2 | Jul 30, 2024 | Mar 29, 2004 |
| Freebsd | — | Upgrade apache | Dec 10, 2025 | Mar 8, 2004 |
| Gentoo Linux | — | Upgrade www-servers/apache. | Oct 30, 2017 | Mar 29, 2004 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub