The IPv6 URI parsing routines in the apr-util library for Apache 2.0.50 and earlier allow remote attackers to cause a denial of service (child process crash) via a certain URI, as demonstrated using the Codenomicon HTTP Test Tool.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Apr 12, 2012 | Oct 20, 2004 |
| Debian | — | Upgrade apache2 | Jul 30, 2024 | Oct 20, 2004 |
| Freebsd | — | Upgrade apache | Dec 10, 2025 | Sep 15, 2004 |
| Gentoo Linux | — | Upgrade net-www/mod_dav.Upgrade www-servers/apache. | Oct 30, 2017 | Oct 20, 2004 |
| Suse | — | Upgrade apache2-docUpgrade apache2-example-pagesUpgrade apache2Upgrade apache2-develUpgrade libapr0Upgrade apache2-preforkUpgrade apache2-worker | Feb 17, 2015 | Oct 20, 2004 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub