CVE-2011-0419
Apache Portable Runtime < 1.4.3 - Resource Allocation Without Limits
Title source: ruleDescription
Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Maksymilian Arciemowicz · phpdoslinux
https://www.exploit-db.com/exploits/35738
References (58)
... and 38 more
Scores
EPSS
0.4878
EPSS Percentile
97.8%
Details
CWE
CWE-770
Status
published
Products (12)
apache/http_server
2.0.0 - 2.0.65
apache/portable_runtime
< 1.4.3
apple/mac_os_x
10.6.0
debian/debian_linux
5.0
debian/debian_linux
6.0
debian/debian_linux
7.0
freebsd/freebsd
google/android
netbsd/netbsd
5.1
openbsd/openbsd
4.8
... and 2 more
Published
May 16, 2011
Tracked Since
Feb 18, 2026