DEBIAN-CVE-2009-1890

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2009-1890
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1890.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2009-1890
Upstream
Downstream
Published
2009-07-05T16:30:00Z
Modified
2026-09-11T06:47:38Z
Summary
[none]
Details

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.

References

Affected packages

Debian:12 / apache2

Package

Name
apache2
Purl
pkg:deb/debian/apache2?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.2.11-7

Ecosystem specific 

{
    "urgency":  "medium"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1890.json"

Debian:13 / apache2

Package

Name
apache2
Purl
pkg:deb/debian/apache2?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.2.11-7

Ecosystem specific 

{
    "urgency":  "medium"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1890.json"

Debian:14 / apache2

Package

Name
apache2
Purl
pkg:deb/debian/apache2?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.2.11-7

Ecosystem specific 

{
    "urgency":  "medium"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1890.json"