CVE-2007-3304: Apache HTTP Server

Medium severity, CVSS 4.7. EPSS: 3.3% chance of exploitation in the next 30 days.

Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer."

Affected products

• Apache HTTP Server: from 1.3.0, before 1.3.39 (fixed in 1.3.39); from 2.0.0, before 2.0.61 (fixed in 2.0.61); from 2.2.0, before 2.2.6 (fixed in 2.2.6)
• Canonical Ubuntu Linux: version 6.06 only; version 6.10 only; version 7.04 only
• Fedoraproject Fedora: version 7 only
• Red Hat Enterprise Linux Desktop: version 5.0 only
• Red Hat Enterprise Linux Server: version 5.0 only
• Red Hat Enterprise Linux Workstation: version 5.0 only

Published 2007-06-20. Last modified 2026-06-16.