The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connect…

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Advisories 9

• RHSA-2010:0602 Red Hat Security Advisory: Red Hat Certificate System 7.3 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
• RHSA-2009:1580 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
• RHSA-2009:1148 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
• RHSA-2009:1205 Red Hat Security Advisory: httpd security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
• DSA-1834-1 apache2 apache2-mpm-itk - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
• openSUSE-SU-2024:10268-1 apache2-2.4.23-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
• RHSA-2009:1160 Red Hat Security Advisory: httpd22 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
• RHSA-2009:1156 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
• RHSA-2009:1155 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Nov 22, 2025

References

• [apache-httpd-dev] 20090628 mod_deflate DoS mailing-list
• FEDORA-2009-8812 vendor-advisory
• SUSE-SA:2009:050 vendor-advisory
• http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0142
• 35781 third-party-advisory
• PK99480 vendor-advisory
• oval:org.mitre.oval:def:12361 vdb-entry signature
• MDVSA-2009:149 vendor-advisory
• PK91361 vendor-advisory
• SSRT090208 vendor-advisory
• RHSA-2009:1156 vendor-advisory
• 35865 third-party-advisory
• ADV-2009-1841 vdb-entry
• 37152 third-party-advisory
• 1022529 vdb-entry
• [apache-httpd-dev] 20090703 Re: mod_deflate DoS mailing-list
• DSA-1834 vendor-advisory
• 20091113 rPSA-2009-0142-2 httpd mod_ssl mailing-list
• oval:org.mitre.oval:def:8632 vdb-entry signature
• HPSBUX02612 vendor-advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534712
• GLSA-200907-04 vendor-advisory
• http://wiki.rpath.com/Advisories:rPSA-2009-0142
• RHSA-2009:1148 vendor-advisory
• oval:org.mitre.oval:def:9248 vdb-entry signature
• USN-802-1 vendor-advisory
• 37221 third-party-advisory
• ADV-2009-3184 vdb-entry
• 35793 third-party-advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=509125
• APPLE-SA-2009-11-09-1 vendor-advisory
• 35721 third-party-advisory
• http://support.apple.com/kb/HT3937
• 55782 vdb-entry
• [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
• [httpd-cvs] 20210330 svn commit: r1888194 [5/13] - /httpd/site/trunk/content/security/json/ mailing-list
• [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
• [httpd-cvs] 20210330 svn commit: r1073139 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
• [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
• [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list
• [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
• [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
• [httpd-cvs] 20210330 svn commit: r1073149 [6/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
• [httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
• [httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
• [httpd-cvs] 20210606 svn commit: r1075467 [1/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
• [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list