CVE-2004-0809: Apache HTTP Server

Medium severity, CVSS 5.0. EPSS: 17.2% chance of exploitation in the next 30 days.

The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK requests for a location that allows WebDAV authoring access.

Affected products

• Apache HTTP Server: from 2.0.35, before 2.0.51 (fixed in 2.0.51)
• Debian Debian Linux: version 3.0 only
• Gentoo Linux: version 1.4 only
• HP HP-Ux: version 11.00 only; version 11.11 only; version 11.22 only; version 11.23 only
• HP Secure Web Server For TRU64: version 4.0_f only; version 4.0_g only; version 5.0_a only; version 5.1 only; version 5.1_a only; version 5.8.1 only; …
• Mandrakesoft Mandrake Linux: version 9.2 only; version 10.0 only
• Red Hat Enterprise Linux: version 3.0 only
• Red Hat Enterprise Linux Desktop: version 3.0 only
• Trustix Secure Linux: version 2.0 only; version 2.1 only
• Turbolinux Turbolinux Desktop: version 10.0 only
• Turbolinux Turbolinux Home: any version
• Turbolinux Turbolinux Server: version 10.0 only

Published 2004-09-16. Last modified 2026-06-16.