HIGH
apr-util billion laughs attack
Published Jun 6, 2009
7.5
HIGHCVSS 3.1
EPSS 52.99%
Description
The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.
Affected products
No data.
Configuration 3
- 9
Configuration 4
- 4.0
Configuration 5
OR
- 6.06
- 8.04
- 8.10
- 9.04
Configuration 6
OR
- 9
- 10
- 11
Configuration 7
- n/a
Configuration 8
- ≥ 2.2.0 · < 2.2.12
No data.
JBEWS 1.0 for RHEL 4
httpd22-0:2.2.10-23.1.ep5.el4
Fixed · RHSA-2009:1160
Red Hat Certificate System 7.3
ant-0:1.6.5-1jpp_1rh
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
avalon-logkit-0:1.2-2jpp_4rh
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
axis-0:1.2.1-1jpp_3rh
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
classpathx-jaf-0:1.0-2jpp_6rh
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
classpathx-mail-0:1.1.1-2jpp_8rh
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
geronimo-specs-0:1.0-0.M4.1jpp_10rh
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
jakarta-commons-modeler-0:2.0-3jpp_2rh
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
log4j-0:1.2.12-1jpp_1rh
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
mx4j-1:3.0.1-1jpp_4rh
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
pcsc-lite-0:1.3.3-3.el4
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
rhpki-ca-0:7.3.0-20.el4
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
rhpki-java-tools-0:7.3.0-10.el4
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
rhpki-kra-0:7.3.0-14.el4
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
rhpki-manage-0:7.3.0-19.el4
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
rhpki-native-tools-0:7.3.0-6.el4
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
rhpki-ocsp-0:7.3.0-13.el4
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
rhpki-tks-0:7.3.0-13.el4
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
tomcat5-0:5.5.23-0jpp_4rh.16
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
xerces-j2-0:2.7.1-1jpp_1rh
Fixed · RHSA-2010:0602
Red Hat Certificate System 7.3
xml-commons-0:1.3.02-2jpp_1rh
Fixed · RHSA-2010:0602
Red Hat Enterprise Linux 3
httpd-0:2.0.46-73.ent
Fixed · RHSA-2009:1108
Red Hat Enterprise Linux 4
apr-util-0:0.9.4-22.el4_8.1
Fixed · RHSA-2009:1107
Red Hat Enterprise Linux 5
apr-util-0:1.2.7-7.el5_3.1
Fixed · RHSA-2009:1107
| Product | Package | State | Advisory |
|---|---|---|---|
| JBEWS 1.0 for RHEL 4 | httpd22-0:2.2.10-23.1.ep5.el4 | Fixed | RHSA-2009:1160 |
| Red Hat Certificate System 7.3 | ant-0:1.6.5-1jpp_1rh | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | avalon-logkit-0:1.2-2jpp_4rh | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | axis-0:1.2.1-1jpp_3rh | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | classpathx-jaf-0:1.0-2jpp_6rh | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | classpathx-mail-0:1.1.1-2jpp_8rh | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | geronimo-specs-0:1.0-0.M4.1jpp_10rh | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | jakarta-commons-modeler-0:2.0-3jpp_2rh | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | log4j-0:1.2.12-1jpp_1rh | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | mx4j-1:3.0.1-1jpp_4rh | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | pcsc-lite-0:1.3.3-3.el4 | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | rhpki-ca-0:7.3.0-20.el4 | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | rhpki-java-tools-0:7.3.0-10.el4 | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | rhpki-kra-0:7.3.0-14.el4 | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | rhpki-manage-0:7.3.0-19.el4 | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | rhpki-native-tools-0:7.3.0-6.el4 | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | rhpki-ocsp-0:7.3.0-13.el4 | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | rhpki-tks-0:7.3.0-13.el4 | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | tomcat5-0:5.5.23-0jpp_4rh.16 | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | xerces-j2-0:2.7.1-1jpp_1rh | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 | xml-commons-0:1.3.02-2jpp_1rh | Fixed | RHSA-2010:0602 |
| Red Hat Enterprise Linux 3 | httpd-0:2.0.46-73.ent | Fixed | RHSA-2009:1108 |
| Red Hat Enterprise Linux 4 | apr-util-0:0.9.4-22.el4_8.1 | Fixed | RHSA-2009:1107 |
| Red Hat Enterprise Linux 5 | apr-util-0:1.2.7-7.el5_3.1 | Fixed | RHSA-2009:1107 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
7.5 HIGH NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact High
No CVSS v3.0 score for this CVE.
5.0 MEDIUM NVD
AV:N/AC:L/Au:N/C:N/I:N/A:P
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
52.99% 0.52988
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.52988
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (20 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 52.99% (0.52988) | 98.95th | v5 (v2026.06.15) |
| Jun 15, 2026 | 53.27% (0.53268) | 98.84th | v5 (v2026.06.15) |
| Jun 13, 2026 | 2.01% (0.02006) | 84.13th | v4 (v2025.03.14) |
| Mar 17, 2025 | 3.14% (0.03139) | 86.00th | v4 (v2025.03.14) |
| Feb 25, 2025 | 36.26% (0.36263) | 97.25th | v3 (v2023.03.01) |
| Jan 20, 2025 | 33.54% (0.33540) | 97.11th | v3 (v2023.03.01) |
| Dec 17, 2024 | 35.47% (0.35469) | 97.15th | v3 (v2023.03.01) |
| Nov 9, 2024 | 18.96% (0.18965) | 96.38th | v3 (v2023.03.01) |
| Oct 3, 2024 | 17.73% (0.17730) | 96.22th | v3 (v2023.03.01) |
| May 13, 2024 | 22.08% (0.22081) | 96.44th | v3 (v2023.03.01) |
| Feb 25, 2024 | 16.88% (0.16876) | 95.89th | v3 (v2023.03.01) |
| Feb 3, 2024 | 18.95% (0.18950) | 95.82th | v3 (v2023.03.01) |
| Jan 15, 2024 | 2.46% (0.02461) | 88.93th | v3 (v2023.03.01) |
| Nov 8, 2023 | 1.04% (0.01038) | 82.21th | v3 (v2023.03.01) |
| Nov 1, 2023 | 1.27% (0.01268) | 84.16th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.97% (0.00973) | 81.04th | v3 (v2023.03.01) |
| Mar 6, 2023 | 48.24% (0.48236) | 98.61th | v2 (v2022.01.01) |
| Jul 18, 2022 | 48.24% (0.48236) | 98.49th | v2 (v2022.01.01) |
| Jul 17, 2022 | 15.27% (0.15272) | 95.82th | v2 (v2022.01.01) |
| Feb 4, 2022 | 48.24% (0.48236) | 98.11th | v2 (v2022.01.01) |
Weaknesses (1)
References (64)
- http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html vendor-advisoryx_refsource_APPLEMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
- http://marc.info/?l=apr-dev&m=124396021826125&w=2 mailing-listx_refsource_MLISTMailing ListPatch
- http://marc.info/?l=bugtraq&m=129190899612998&w=2 vendor-advisoryx_refsource_HPMailing List
- http://secunia.com/advisories/34724 third-party-advisoryx_refsource_SECUNIABroken LinkThird Party Advisory
- http://secunia.com/advisories/35284 third-party-advisoryx_refsource_SECUNIABroken LinkThird Party Advisory
- http://secunia.com/advisories/35360 third-party-advisoryx_refsource_SECUNIABroken LinkThird Party Advisory
- http://secunia.com/advisories/35395 third-party-advisoryx_refsource_SECUNIABroken LinkThird Party Advisory
- http://secunia.com/advisories/35444 third-party-advisoryx_refsource_SECUNIABroken LinkThird Party Advisory
- http://secunia.com/advisories/35487 third-party-advisoryx_refsource_SECUNIABroken LinkThird Party Advisory
- http://secunia.com/advisories/35565 third-party-advisoryx_refsource_SECUNIABroken LinkThird Party Advisory
- http://secunia.com/advisories/35710 third-party-advisoryx_refsource_SECUNIABroken LinkThird Party Advisory
- http://secunia.com/advisories/35797 third-party-advisoryx_refsource_SECUNIABroken LinkThird Party Advisory
- http://secunia.com/advisories/35843 third-party-advisoryx_refsource_SECUNIABroken LinkThird Party Advisory
- http://secunia.com/advisories/36473 third-party-advisoryx_refsource_SECUNIABroken LinkThird Party Advisory
- http://secunia.com/advisories/37221 third-party-advisoryx_refsource_SECUNIABroken LinkThird Party Advisory
- http://security.gentoo.org/glsa/glsa-200907-03.xml vendor-advisoryx_refsource_GENTOOThird Party Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.538210 vendor-advisoryx_refsource_SLACKWAREBroken LinkThird Party Advisory
- http://support.apple.com/kb/HT3937 x_refsource_CONFIRMBroken Link
- http://svn.apache.org/viewvc?view=rev&revision=781403 x_refsource_CONFIRMPatch
- http://wiki.rpath.com/Advisories:rPSA-2009-0123 x_refsource_CONFIRMBroken Link
- http://www-01.ibm.com/support/docview.wss?uid=swg1PK88342 vendor-advisoryx_refsource_AIXAPARBroken Link
- http://www-01.ibm.com/support/docview.wss?uid=swg1PK91241 vendor-advisoryx_refsource_AIXAPARBroken LinkThird Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1PK99478 vendor-advisoryx_refsource_AIXAPARBroken LinkThird Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg27014463 x_refsource_CONFIRMBroken LinkThird Party Advisory
- http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3 x_refsource_CONFIRMBroken Link
- http://www.debian.org/security/2009/dsa-1812 vendor-advisoryx_refsource_DEBIANMailing ListThird Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:131 vendor-advisoryx_refsource_MANDRIVABroken LinkThird Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 vendor-advisoryx_refsource_MANDRIVABroken LinkThird Party Advisory
- http://www.openwall.com/lists/oss-security/2009/06/03/4 mailing-listx_refsource_MLISTMailing List
- http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html x_refsource_CONFIRMPatchThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2009-1107.html vendor-advisoryx_refsource_REDHATBroken LinkThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2009-1108.html vendor-advisoryx_refsource_REDHATBroken LinkThird Party Advisory
- http://www.securityfocus.com/archive/1/506053/100/0/threaded mailing-listx_refsource_BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/35253 vdb-entryx_refsource_BIDBroken LinkThird Party AdvisoryVDB Entry
- http://www.ubuntu.com/usn/usn-786-1 vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- http://www.ubuntu.com/usn/usn-787-1 vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- http://www.vupen.com/english/advisories/2009/1907 vdb-entryx_refsource_VUPENBroken LinkThird Party Advisory
- http://www.vupen.com/english/advisories/2009/3184 vdb-entryx_refsource_VUPENBroken LinkThird Party Advisory
- http://www.vupen.com/english/advisories/2010/1107 vdb-entryx_refsource_VUPENBroken LinkThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2009-1955 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=504555 Issue Tracking
- https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLISTMailing ListPatch
- https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLISTMailing ListPatch
- https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLISTMailing ListPatch
- https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLISTMailing ListPatch
- https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLISTMailing ListPatch
- https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLISTMailing ListPatch
- https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLISTMailing ListPatch
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLISTMailing ListPatch
- https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLISTMailing ListPatch
- https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLISTMailing ListPatch
- https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLISTMailing ListPatch
- https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLISTMailing ListPatch
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLISTMailing ListPatch
- https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E mailing-listx_refsource_MLISTMailing ListPatch
- https://nvd.nist.gov/vuln/detail/CVE-2009-1955
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10270 vdb-entrysignaturex_refsource_OVALBroken LinkThird Party Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12473 vdb-entrysignaturex_refsource_OVALBroken LinkThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2009-1955
- https://www.exploit-db.com/exploits/8842 exploitx_refsource_EXPLOIT-DBVDB Entry
- https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01173.html vendor-advisoryx_refsource_FEDORAMailing List
- https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01201.html vendor-advisoryx_refsource_FEDORAMailing List
- https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01228.html vendor-advisoryx_refsource_FEDORAMailing List
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jun 6, 2009
Updated Aug 7, 2024
Reserved Jun 6, 2009
Link CVE-2009-1955
CISA Vulnrichment
Updated n/a