CVE-2009-1890: Apache HTTP Server

High severity, CVSS 7.1. EPSS: 16.2% chance of exploitation in the next 30 days.

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.

Affected products

• Apache HTTP Server: from 2.2.0, before 2.2.12 (fixed in 2.2.12)
• Canonical Ubuntu Linux: version 6.06 only; version 8.04 only; version 8.10 only; version 9.04 only
• Debian Debian Linux: version 4.0 only; version 5.0 only; version 6.0 only
• Fedoraproject Fedora: version 11 only
• Red Hat Enterprise Linux Desktop: version 5.0 only
• Red Hat Enterprise Linux Eus: version 5.3 only
• Red Hat Enterprise Linux Server: version 5.0 only
• Red Hat Enterprise Linux Server Aus: version 5.3 only
• Red Hat Enterprise Linux Workstation: version 5.0 only

Published 2009-07-05. Last modified 2026-06-16.