Every CVE Search/ Get API key

CVE-2011-1928

The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3...

4.3 MediumFix available

The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.

Exploit likelihood

10.3%Up 3.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.

Record
CVE-2011-1928
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-399
Updated
2026-11-02
CVE List No score

The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.

Record
CVE-2011-1928
Updated
2026-11-02
EUVDEUVD-2011-1926 No score

The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.

Record
EUVD-2011-1926
Updated
2026-11-03
GitHub AdvisoriesGHSA-9h43-8fmr-wxgx No score

The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3...

The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.

Record
GHSA-9h43-8fmr-wxgx
Updated
2026-11-02
OSVBELL-CVE-2011-1928 4.3

CVE-2011-1928 does not affect BellSoft software

Record
BELL-CVE-2011-1928
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Updated
2026-11-02
OSV No score

The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.

Record
CVE-2011-1928
Updated
2026-11-02
OSVDEBIAN-CVE-2011-1928 No score

The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.

Record
DEBIAN-CVE-2011-1928
Updated
2026-11-02
OSVopenSUSE-SU-2024:10063-1 No score

libapr1-1.5.2-3.4 on GA media

These are all security issues fixed in the libapr1-1.5.2-3.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10063-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11596-1 No score

apr-devel-1.7.0-3.1 on GA media

These are all security issues fixed in the apr-devel-1.7.0-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11596-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apr
Debian:12
 before 1.4.5-1
1.4.5-1
apr
Debian:13
 before 1.4.5-1
1.4.5-1
apr
Debian:14
 before 1.4.5-1
1.4.5-1
apr
Debian:5.0
 before 1.2.12-5+lenny4, plus listed versions
1.2.12-51.2.12-5+lenny11.2.12-5+lenny21.2.12-5+lenny3
1.2.12-5+lenny4
apr
Debian:6.0
 before 1.4.2-6+squeeze2, plus listed versions
1.4.2-61.4.2-6+squeeze1
1.4.2-6+squeeze2
apr
Red Hat:enterprise_linux:4::as
 before 0:0.9.4-26.el4
0:0.9.4-26.el4
apr-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:0.9.4-26.el4
0:0.9.4-26.el4
apr-devel
Red Hat:enterprise_linux:4::as
 before 0:0.9.4-26.el4
0:0.9.4-26.el4
apr
Red Hat:enterprise_linux:4::desktop
 before 0:0.9.4-26.el4
0:0.9.4-26.el4
apr-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:0.9.4-26.el4
0:0.9.4-26.el4
Show 22 moreShow less
Affected packages
PackageAffectedFixed
apr-devel
Red Hat:enterprise_linux:4::desktop
 before 0:0.9.4-26.el4
0:0.9.4-26.el4
apr
Red Hat:enterprise_linux:4::es
 before 0:0.9.4-26.el4
0:0.9.4-26.el4
apr-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:0.9.4-26.el4
0:0.9.4-26.el4
apr-devel
Red Hat:enterprise_linux:4::es
 before 0:0.9.4-26.el4
0:0.9.4-26.el4
apr
Red Hat:enterprise_linux:4::ws
 before 0:0.9.4-26.el4
0:0.9.4-26.el4
apr-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:0.9.4-26.el4
0:0.9.4-26.el4
apr-devel
Red Hat:enterprise_linux:4::ws
 before 0:0.9.4-26.el4
0:0.9.4-26.el4
apr
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.2.7-11.el5_6.5
0:1.2.7-11.el5_6.5
apr-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.2.7-11.el5_6.5
0:1.2.7-11.el5_6.5
apr-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.2.7-11.el5_6.5
0:1.2.7-11.el5_6.5
apr
Red Hat:enterprise_linux:5::client
 before 0:1.2.7-11.el5_6.5
0:1.2.7-11.el5_6.5
apr-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:1.2.7-11.el5_6.5
0:1.2.7-11.el5_6.5
apr-docs
Red Hat:enterprise_linux:5::client
 before 0:1.2.7-11.el5_6.5
0:1.2.7-11.el5_6.5
apr
Red Hat:enterprise_linux:5::server
 before 0:1.2.7-11.el5_6.5
0:1.2.7-11.el5_6.5
apr-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:1.2.7-11.el5_6.5
0:1.2.7-11.el5_6.5
apr-devel
Red Hat:enterprise_linux:5::server
 before 0:1.2.7-11.el5_6.5
0:1.2.7-11.el5_6.5
apr-docs
Red Hat:enterprise_linux:5::server
 before 0:1.2.7-11.el5_6.5
0:1.2.7-11.el5_6.5
apr
Red Hat:enterprise_linux:6::server
 before 0:1.3.9-3.el6_1.2
0:1.3.9-3.el6_1.2
apr-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:1.3.9-3.el6_1.2
0:1.3.9-3.el6_1.2
apr-devel
Red Hat:enterprise_linux:6::server
 before 0:1.3.9-3.el6_1.2
0:1.3.9-3.el6_1.2
apr
openSUSE:Tumbleweed
 before 1.5.2-3.4
1.5.2-3.4
apr
openSUSE:Tumbleweed
 before 1.7.0-3.1
1.7.0-3.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-1928 is a medium vulnerability (CVSS 4.3) in Apache Http Server, published May 15, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 10.3%, the 95th percentile. Fixed in apr 1.4.5-1.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open