Description
The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apr | 1.4.5-1 | — |
| Debian 13 | apr | 1.4.5-1 | — |
| Debian 12 | apr | 1.4.5-1 | — |
| Debian 6.0 | apr | 1.4.2-6+squeeze2 | DSA-2237-2 |
| Debian 5.0 | apr | 1.2.12-5+lenny4 | DSA-2237-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | apr +1 | 1.3.9-3.el6_1.2 | RHSA-2011:0844 |
| RHEL 5 | apr +2 | 1.2.7-11.el5_6.5 | RHSA-2011:0844 |
| RHEL 4 | apr +1 | 0.9.4-26.el4 | RHSA-2011:0844 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apr | 1.5.2-3.4 | openSUSE-SU-2024:11596-1, openSUSE-SU-2024:10063-1 |
Advisories 4
- RHSA-2011:0844 Red Hat Security Advisory: apr security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2237-2 apr - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10063-1 libapr1-1.5.2-3.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11596-1 apr-devel-1.7.0-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2011:0844 vendor-advisory
- 44661 third-party-advisory
- SSRT100966 vendor-advisory
- 48308 third-party-advisory
- MDVSA-2011:095 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=627182
- ADV-2011-1289 vdb-entry
- 44613 third-party-advisory
- [www-announce] 20110519 Regressions in httpd 2.2.18, apr 1.4.4, and apr-util 1.3.11 mailing-list
- [oss-security] 20110519 CVE request: DoS in apr due to CVE-2011-0419 fix mailing-list
- 44780 third-party-advisory
- ADV-2011-1290 vdb-entry
- 44558 third-party-advisory
- [oss-security] 20110519 Re: CVE request: DoS in apr due to CVE-2011-0419 fix mailing-list
- [httpd-announce] 20110519 Regressions in httpd 2.2.18, apr 1.4.4, and apr-util 1.3.11 mailing-list
- https://issues.apache.org/bugzilla/show_bug.cgi?id=51219
- SUSE-SU-2011:1229 vendor-advisory