7.7 High
AI Score
Confidence
High
7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
0.966 High
EPSS
Percentile
99.5%
The byte-range filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial-of-service (memory and CPU consumption) using a** Range** header that expresses multiple overlapping ranges.
When this vulnerability is exploited, the httpd process consumes all available CPU cycles. As a result of CPU starvation, the Configuration utility, SSH sessions, and other userland processes may appear extremely slow or completely unresponsive. On BIG-IP systems, if the system hardware watchdog timer is not updated for more than 10 seconds, the hardware watchdog restarts the system.
Impact
The performance of userland processes may be severely impaired, and the system may eventually reboot.