CVE-2011-3192: Apache HTTP Server

High severity, CVSS 7.8. EPSS: 98.8% chance of exploitation in the next 30 days.

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

Affected products

• Apache HTTP Server: from 2.0.35, before 2.0.65 (fixed in 2.0.65); from 2.2.0, before 2.2.20 (fixed in 2.2.20)
• Canonical Ubuntu Linux: version 8.04 only; version 10.04 only; version 10.10 only; version 11.04 only
• Opensuse Opensuse: version 11.3 only; version 11.4 only
• Suse Linux Enterprise Server: version 10 only; version 11 only
• Suse Linux Enterprise Software Development Kit: version 10 only; version 11 only

Published 2011-08-29. Last modified 2026-06-16.