Description
Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.2.16-3 | — |
| Debian 14 | apr-util | 1.3.9+dfsg-4 | — |
| Debian 13 | apache2 | 2.2.16-3 | — |
| Debian 13 | apr-util | 1.3.9+dfsg-4 | — |
| Debian 12 | apache2 | 2.2.16-3 | — |
| Debian 12 | apr-util | 1.3.9+dfsg-4 | — |
| Debian 5.0 | apr-util | 1.2.12+dfsg-8+lenny5 | DSA-2117-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | apr-util +6 | 1.3.9-3.el6_0.1 | RHSA-2010:0950 |
| RHEL 5 | apr-util +3 | 1.2.7-11.el5_5.2 | RHSA-2010:0950 |
| RHEL 4 | apr-util +1 | 0.9.4-22.el4_8.3 | RHSA-2010:0950 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 1 | ant | 1.7.1-13.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | ant-commons-net | 1.7.1-14.ep5.el6 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | ant-jmf +16 | 1.7.1-13.jdk6.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | antlr | 2.7.7-7.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | bcel | 5.2-8.1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | cglib | 2.2-5.1.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | dom4j | 1.6.1-11.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | ecj | 1:3.3.1.1-3.2.2.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | ecj3 | 1:3.3.1.1-3.1.1.1.jdk6.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | glassfish-jaf | 1.1.0-6.1.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | glassfish-javamail | 1.4.2-0.4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | glassfish-jsf | 1.2_13-2.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | hibernate3 +1 | 1:3.3.2-1.4.GA_CP04.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | hibernate3-annotations +1 | 3.4.0-3.2.GA_CP04.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | hibernate3-commons-annotations +1 | 3.1.0-1.8.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | hibernate3-ejb-persistence-3.0-api +1 | 1:1.0.2-3.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | hibernate3-entitymanager +1 | 3.4.0-4.3.GA_CP04.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | httpd +2 | 2.2.17-11.1.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | httpd-tools | 2.2.17-11.2.ep5.el6 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | httpd22 +6 | 2.2.17-14.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-beanutils | 1.8.0-4.1.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-chain | 1.2-2.2.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-codec | 1.3-9.1.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-collections +1 | 3.2.1-4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-daemon | 1:1.0.5-1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-daemon-jsvc | 1:1.0.5-1.4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-dbcp +1 | 1.2.1-16.2.ep5.el6 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-digester | 1.8.1-8.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-el | 1.0-19.2.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-fileupload | 1:1.1.1-7.4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-httpclient | 1:3.1-1.1.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-io | 1.4-1.3.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-launcher | 1.1-4.6.1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-logging +1 | 1.1.1-0.4.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-logging-jboss | 1.1-10.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-modeler | 2.0-4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-pool +1 | 1.3-11.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-validator | 1.3.1-7.5.1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-oro | 2.0.8-3.3.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-taglibs-standard | 1.1.1-9.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | javassist | 3.12.0-1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jboss-common-core | 2.2.17-1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jboss-common-logging-jdk +1 | 2.1.2-1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jboss-javaee +3 | 5.0.1-2.9.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jcommon | 1.0.16-1.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jfreechart | 1.0.13-2.3.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | log4j | 1.2.14-18.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | mod_cluster +5 | 1.0.10-2.GA_CP01.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | mod_jk +2 | 1.2.31-1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | mod_ssl | 1:2.2.17-11.1.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | mod_ssl22 | 1:2.2.17-14.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | mx4j | 1:3.0.1-9.3.4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | objectweb-asm | 3.1-5.3.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | objectweb-asm31 | 3.1-12.1.ep5.el6 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | regexp | 1.5-1.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | struts12 | 1.2.9-3.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | tomcat-jkstatus-ant | 1.2.31-2.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | tomcat-native | 1.1.20-2.0.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | tomcat5 +12 | 5.5.33-14_patch_04.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | tomcat6 +9 | 6.0.32-14_patch_03.ep5.el6 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | xalan-j2 | 2.7.1-5.3_patch_04.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | xerces-j2 | 2.9.1-3.patch01.1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | xml-commons +3 | 1.3.04-7.10.jdk6.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | xml-commons-which10 +4 | 1.3.04-7.14.ep5.el6 | RHSA-2011:0897 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.23-4.1 | openSUSE-SU-2024:10268-1 |
| openSUSE Tumbleweed | apr-util | 1.5.4-4.4 | openSUSE-SU-2024:11586-1, openSUSE-SU-2024:10568-1 |
Advisories 6
- RHSA-2011:0897 Red Hat Security Advisory: JBoss Enterprise Web Server 1.0.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2010:0950 Red Hat Security Advisory: apr-util security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-2117-1 apr-util - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10568-1 libapr-util1-1.5.4-4.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10268-1 apache2-2.4.23-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11586-1 apr-util-devel-1.6.1-8.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://svn.apache.org/viewvc?view=revision&revision=1003494
- http://svn.apache.org/viewvc?view=revision&revision=1003492
- 43285 third-party-advisory
- ADV-2010-3065 vdb-entry
- http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3
- ADV-2010-3064 vdb-entry
- SSA:2011-041-01 vendor-advisory
- FEDORA-2010-15953 vendor-advisory
- http://security-tracker.debian.org/tracker/CVE-2010-1623
- FEDORA-2010-15916 vendor-advisory
- ADV-2010-2806 vdb-entry
- 41701 third-party-advisory
- USN-1022-1 vendor-advisory
- RHSA-2010:0950 vendor-advisory
- 42361 third-party-advisory
- oval:org.mitre.oval:def:12800 vdb-entry signature
- http://svn.apache.org/viewvc?view=revision&revision=1003626
- PM23263 vendor-advisory
- RHSA-2011:0897 vendor-advisory
- ADV-2010-2556 vdb-entry
- 42403 third-party-advisory
- 43673 vdb-entry
- http://svn.apache.org/viewvc?view=revision&revision=1003495
- RHSA-2011:0896 vendor-advisory
- 42367 third-party-advisory
- http://blogs.sun.com/security/entry/cve_2010_1623_memory_leak
- 43211 third-party-advisory
- 42015 third-party-advisory
- 42537 third-party-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1003493
- HPSBUX02645 vendor-advisory
- SUSE-SU-2011:1229 vendor-advisory
- MDVSA-2010:192 vendor-advisory
- ADV-2010-2557 vdb-entry
- ADV-2010-3074 vdb-entry
- USN-1021-1 vendor-advisory
- ADV-2011-0358 vdb-entry
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [7/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [7/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [7/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
- [httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
- [httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
- [httpd-cvs] 20210606 svn commit: r1075467 [1/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list