CVE-2007-1863: Apache HTTP Server

Medium severity, CVSS 5.0. EPSS: 11.8% chance of exploitation in the next 30 days.

cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.

Affected products

• Apache HTTP Server: from 2.0.37, before 2.0.61 (fixed in 2.0.61); from 2.2.0, before 2.2.6 (fixed in 2.2.6)
• Apple Mac OS X Server: version 10.0 only; version 10.1 only; version 10.1.1 only; version 10.1.2 only; version 10.1.3 only; version 10.1.4 only; …

Published 2007-06-27. Last modified 2026-06-16.