CVE-2011-3192
- State
- Published
- Severity
- Not scored
- Published
- Aug 29, 2011
- Updated
- Aug 6, 2024
- Reserved
- Aug 19, 2011
Description
The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 45606third-party-advisory
- RHSA-2011:1369vendor-advisory
- RHSA-2011:1329vendor-advisory
- HPSBUX02707vendor-advisory
- SUSE-SU-2011:1010vendor-advisory
- SSRT100966vendor-advisory
- openSUSE-SU-2011:0993vendor-advisory
- http://www.gossamer-threads.com/lists/apache/dev/401638
- 1025960vdb-entry
- [dev] 20110823 Re: DoS with mod_deflate & range requestsmailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=732928
- http://www.oracle.com/technetwork/topics/security/alert-cve-2011-3192-485304.html
- SSRT100624vendor-advisory
- 17696exploit
- https://issues.apache.org/bugzilla/show_bug.cgi?id=51714
- HPSBUX02702vendor-advisory
- 46000third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2011-330135.html
- http://blogs.oracle.com/security/entry/security_alert_for_cve_2011
- SSRT100619vendor-advisory
- 20110830 Apache HTTPd Range Header Denial of Service Vulnerabilityvendor-advisory
- USN-1199-1vendor-advisory
- MDVSA-2011:130vendor-advisory
- 49303vdb-entry
- 74721vdb-entry
- https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
- 20110824 Re: Apache Killermailing-list
- APPLE-SA-2011-10-12-3vendor-advisory
- oval:org.mitre.oval:def:14824vdb-entrysignature
- [announce] 20110824 Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x \(CVE-2011-3192\)mailing-list
- RHSA-2011:1330vendor-advisory
- apache-http-byterange-dos(69396)vdb-entry
- 46126third-party-advisory
- RHSA-2011:1245vendor-advisory
- oval:org.mitre.oval:def:18827vdb-entrysignature
- http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- http://www.apache.org/dist/httpd/Announcement2.2.html
- http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
- 46125third-party-advisory
- VU#405811third-party-advisory
- 20110820 Apache Killermailing-list
- SSRT100852vendor-advisory
- http://support.apple.com/kb/HT5002
- SUSE-SU-2011:1216vendor-advisory
- oval:org.mitre.oval:def:14762vdb-entrysignature
- SUSE-SU-2011:1007vendor-advisory
- SUSE-SU-2011:1000vendor-advisory
- RHSA-2011:1294vendor-advisory
- MDVSA-2013:150vendor-advisory
- SUSE-SU-2011:1229vendor-advisory
- RHSA-2011:1300vendor-advisory
- 45937third-party-advisory
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [7/13] - /httpd/site/trunk/content/security/json/mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [7/13] - in /websites/staging/httpd/trunk/content: ./ security/json/mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [8/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/mailing-list
- [httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20210606 svn commit: r1075467 [1/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.