Unscored severity · published Jan 5, 2007
CVE-2007-0086
The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a…
–
CVSS
10.2%
EPSS
No
On KEV
Description
The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
Exploitation
Is it being used?
Exploit prediction (EPSS)10.2% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HS
HTTP Server · Apache
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-0086
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-0086
Broken Link
http://osvdb.org/33456
Third Party Advisory
http://www.securityfocus.com/archive/1/455833/100/0/threaded
Third Party Advisory
http://www.securityfocus.com/archive/1/455879/100/0/threaded
Third Party Advisory
http://www.securityfocus.com/archive/1/455882/100/0/threaded
Third Party Advisory
http://www.securityfocus.com/archive/1/455920/100/0/threaded
More from HTTP Server
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
9.8
CVE-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
9.1
CVE-2024-38475
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
9.0
CVE-2021-40438
mod_proxy SSRF
7.8
CVE-2019-0211
Apache HTTP Server Privilege Escalation Vulnerability