CVE-2009-1890 is a denial-of-service vulnerability affecting the mod_proxy module in Apache HTTP Server versions prior to 2.3.3, impacting distributions from Canonical, Debian, FedoraProject, and Red Hat. This flaw allows remote attackers to cause CPU consumption by sending crafted requests that improperly handle streamed data exceeding the Content-Length when a reverse proxy is configured. Rated with a CVSS score of 7.1 (High) and medium attack complexity, it enables unauthenticated remote attackers to achieve a complete denial of service. While no public exploit code is available on platforms like Metasploit or ExploitDB and it is not listed in CISA's KEV catalog, the vulnerability is flagged as "Hot List: Active," indicating its potential significance or historical exploitation, with some community discussion observed.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.2.0, < 2.2.12CPE matchmatch criteria | cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | ||
11CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:* | ||
4.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:* | ||
5.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:N/I:N/A:C
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2009-1890
May 10, 2022The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3 when a reverse proxy is configured does not properly handle an amount of streamed data that exceeds the Content-Length value which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
Jul 2, 2009httpd: mod_proxy reverse proxy DoS (infinite loop)
Jul 2, 2009