Apache HTTP Server 1.3.x 2.0.35-2.0.64 2.2.0-2.2.19 - Denial of Service via Range Header Overlap
Title source: llmExploitation Summary
CVE-2011-3192 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).
EIP tracks 7 public exploits from researchers including kingcope, tkisason, futurezayka, including a Metasploit module auxiliary/dos/http/apache_range_dos.
AI-analyzed exploit summary This exploit targets a memory exhaustion vulnerability in Apache httpd by sending malformed HTTP Range headers. It uses multiple forks to amplify the attack, leading to remote denial of service (DoS) by exhausting system resources.
Description
The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.
Exploits (7)
This exploit targets a memory exhaustion vulnerability in Apache httpd by sending malformed HTTP Range headers. It uses multiple forks to amplify the attack, leading to remote denial of service (DoS) by exhausting system resources.
This is a Python-based proof-of-concept exploit for CVE-2011-3192, which targets a denial-of-service vulnerability in Apache HTTP Server via crafted Range headers. The script automates the attack by spawning multiple threads to send malicious requests, aiming to choke the server.
This is a functional proof-of-concept exploit for CVE-2011-3192, targeting a denial-of-service vulnerability in Apache HTTP Server via malformed Range headers. It includes both a vulnerability test and an active exploitation mode using asynchronous HTTP requests.
The repository contains only a Dockerfile with no actual exploit code or technical details. It references CVE-2011-3192 but provides no functional PoC, analysis, or vulnerability context.
This repository contains a functional Python-based exploit for CVE-2011-3192, which targets a denial-of-service (DoS) vulnerability in Apache HTTP Server via malformed Range headers. The script automates the attack by spawning multiple threads to send crafted requests, overwhelming the server.
This exploit targets CVE-2011-3192, a denial-of-service vulnerability in Apache HTTP Server. It sends malformed HTTP requests with overlapping byte ranges to trigger excessive resource consumption, causing the server to crash.
This Metasploit module exploits CVE-2011-3192, a denial-of-service vulnerability in Apache HTTP Server versions 2.0.x through 2.0.64 and 2.2.x through 2.2.19. It triggers excessive memory and CPU consumption by sending malformed Range headers with overlapping byte ranges.