Description
The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.2.16-1 | — |
| Debian 13 | apache2 | 2.2.16-1 | — |
| Debian 12 | apache2 | 2.2.16-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | httpd +2 | 2.2.3-43.el5_5.3 | RHSA-2010:0659 |
| RHEL 5 | mod_ssl | 1:2.2.3-43.el5_5.3 | RHSA-2010:0659 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 1 | ant | 1.7.1-13.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | ant-commons-net | 1.7.1-14.ep5.el6 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | ant-jmf +16 | 1.7.1-13.jdk6.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | antlr | 2.7.7-7.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | bcel | 5.2-8.1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | cglib | 2.2-5.1.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | dom4j | 1.6.1-11.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | ecj | 1:3.3.1.1-3.2.2.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | ecj3 | 1:3.3.1.1-3.1.1.1.jdk6.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | glassfish-jaf | 1.1.0-6.1.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | glassfish-javamail | 1.4.2-0.4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | glassfish-jsf | 1.2_13-2.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | hibernate3 +1 | 1:3.3.2-1.4.GA_CP04.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | hibernate3-annotations +1 | 3.4.0-3.2.GA_CP04.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | hibernate3-commons-annotations +1 | 3.1.0-1.8.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | hibernate3-ejb-persistence-3.0-api +1 | 1:1.0.2-3.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | hibernate3-entitymanager +1 | 3.4.0-4.3.GA_CP04.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | httpd +2 | 2.2.17-11.1.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | httpd-tools | 2.2.17-11.2.ep5.el6 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | httpd22 +6 | 2.2.17-14.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-beanutils | 1.8.0-4.1.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-chain | 1.2-2.2.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-codec | 1.3-9.1.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-collections +1 | 3.2.1-4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-daemon | 1:1.0.5-1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-daemon-jsvc | 1:1.0.5-1.4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-dbcp +1 | 1.2.1-16.2.ep5.el6 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-digester | 1.8.1-8.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-el | 1.0-19.2.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-fileupload | 1:1.1.1-7.4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-httpclient | 1:3.1-1.1.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-io | 1.4-1.3.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-launcher | 1.1-4.6.1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-logging +1 | 1.1.1-0.4.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-logging-jboss | 1.1-10.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-modeler | 2.0-4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-pool +1 | 1.3-11.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-validator | 1.3.1-7.5.1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-oro | 2.0.8-3.3.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-taglibs-standard | 1.1.1-9.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | javassist | 3.12.0-1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jboss-common-core | 2.2.17-1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jboss-common-logging-jdk +1 | 2.1.2-1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jboss-javaee +3 | 5.0.1-2.9.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jcommon | 1.0.16-1.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jfreechart | 1.0.13-2.3.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | log4j | 1.2.14-18.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | mod_cluster +5 | 1.0.10-2.GA_CP01.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | mod_jk +2 | 1.2.31-1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | mod_ssl | 1:2.2.17-11.1.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | mod_ssl22 | 1:2.2.17-14.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | mx4j | 1:3.0.1-9.3.4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | objectweb-asm | 3.1-5.3.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | objectweb-asm31 | 3.1-12.1.ep5.el6 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | regexp | 1.5-1.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | struts12 | 1.2.9-3.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | tomcat-jkstatus-ant | 1.2.31-2.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | tomcat-native | 1.1.20-2.0.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | tomcat5 +12 | 5.5.33-14_patch_04.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | tomcat6 +9 | 6.0.32-14_patch_03.ep5.el6 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | xalan-j2 | 2.7.1-5.3_patch_04.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | xerces-j2 | 2.9.1-3.patch01.1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | xml-commons +3 | 1.3.04-7.10.jdk6.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | xml-commons-which10 +4 | 1.3.04-7.14.ep5.el6 | RHSA-2011:0897 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.23-4.1 | openSUSE-SU-2024:10268-1 |
Advisories 3
- RHSA-2011:0897 Red Hat Security Advisory: JBoss Enterprise Web Server 1.0.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2010:0659 Red Hat Security Advisory: httpd security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- openSUSE-SU-2024:10268-1 apache2-2.4.23-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://issues.apache.org/bugzilla/show_bug.cgi?id=49246
- ADV-2011-0291 vdb-entry
- ADV-2010-3064 vdb-entry
- oval:org.mitre.oval:def:12341 vdb-entry signature
- APPLE-SA-2011-03-21-1 vendor-advisory
- RHSA-2010:0659 vendor-advisory
- [apache-announce] 20100725 [ANNOUNCEMENT] Apache HTTP Server 2.2.16 Released mailing-list
- SSRT100782 vendor-advisory
- oval:org.mitre.oval:def:11683 vdb-entry signature
- HPSBUX02612 vendor-advisory
- http://httpd.apache.org/security/vulnerabilities_22.html
- http://blogs.sun.com/security/entry/cve_2010_1452_mod_dav
- RHSA-2011:0897 vendor-advisory
- RHSA-2011:0896 vendor-advisory
- 42367 third-party-advisory
- SUSE-SU-2011:1216 vendor-advisory
- SUSE-SU-2011:1000 vendor-advisory
- SSA:2010-240-02 vendor-advisory
- USN-1021-1 vendor-advisory
- ADV-2010-2218 vdb-entry
- http://support.apple.com/kb/HT4581
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [7/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [7/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [7/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210422 svn commit: r1074079 [2/3] - in /websites/staging/httpd/trunk/content: ./ apreq/ contribute/ contributors/ dev/ docs-project/ docs/ info/ mod_fcgid/ mod_ftp/ mod_mbox/ mod_smtpd/ modules/ security/ test/ test/flood/ mailing-list
- [httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
- [httpd-cvs] 20210606 svn commit: r1075467 [1/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list