CVE-2007-0086 describes a denial-of-service vulnerability in the Apache HTTP Server. An attacker can exploit this by sending a crafted Range header with multiple identical fragments over a TCP connection with a large window size, leading to network bandwidth consumption. This vulnerability has a CVSS score of 7.8, indicating high severity due to its network-based attack vector and complete availability impact. Despite its potential, the exploitability is disputed due to the unusual network configuration required, and there is no evidence of active exploitation, public exploit code, or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:apache:http_server:-:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:N/I:N/A:C
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2007-0086
Sep 8, 2020The Apache HTTP Server when accessed through a TCP connection with a large window size allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties who state that the large window size required by the attack is not normally supported or configured by the server or that a DDoS-style attack would accomplish the same goal
Jan 2, 2007CVE-2007-0086