CVE-2009-1891: Apache HTTP Server

High severity, CVSS 7.1. EPSS: 17.1% chance of exploitation in the next 30 days.

The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).

Affected products

• Apache HTTP Server: from 2.0.35, before 2.0.64 (fixed in 2.0.64); from 2.2.0, before 2.2.12 (fixed in 2.2.12)
• Canonical Ubuntu Linux: version 6.06 only; version 8.04 only; version 8.10 only; version 9.04 only
• Debian Debian Linux: version 4.0 only; version 5.0 only; version 6.0 only
• Fedoraproject Fedora: version 11 only
• Red Hat Enterprise Linux Desktop: version 5.0 only
• Red Hat Enterprise Linux Eus: version 5.3 only
• Red Hat Enterprise Linux Server: version 5.0 only
• Red Hat Enterprise Linux Server Aus: version 5.3 only
• Red Hat Enterprise Linux Workstation: version 5.0 only

Published 2009-07-10. Last modified 2026-06-16.