CVE-2005-2728
The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of...
5.0 MediumFix available
The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.
Exploit likelihood
11.0%Up 3.6 points since Feb 4, 2022
What each source reports
NVD Score used
The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.
- Record
CVE-2005-2728- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.
- Record
CVE-2005-2728- Updated
- 2026-11-02
EUVDEUVD-2005-2729 No score
The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.
- Record
EUVD-2005-2729- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5rc2-352q-326v No score
The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of...
The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.
- Record
GHSA-5rc2-352q-326v- Updated
- 2026-11-02
OSVBELL-CVE-2005-2728
CVE-2005-2728 does not affect BellSoft software
- Record
BELL-CVE-2005-2728- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
OSV No score
The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.
- Record
CVE-2005-2728- Updated
- 2026-11-02
OSVDEBIAN-CVE-2005-2728 No score
The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.
- Record
DEBIAN-CVE-2005-2728- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache2Debian:12 |
before 2.0.54-5 | 2.0.54-5 |
apache2Debian:13 |
before 2.0.54-5 | 2.0.54-5 |
apache2Debian:14 |
before 2.0.54-5 | 2.0.54-5 |
apache2Debian:3.1 |
before 2.0.54-5, plus listed versions 2.0.54-4 |
2.0.54-5 |
httpdRed Hat:enterprise_linux:3::as |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::as |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
httpd-develRed Hat:enterprise_linux:3::as |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
mod_sslRed Hat:enterprise_linux:3::as |
before 1:2.0.46-46.3.ent | 1:2.0.46-46.3.ent |
httpdRed Hat:enterprise_linux:3::desktop |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
Show 34 moreShow less
| Package | Affected | Fixed |
|---|---|---|
httpd-develRed Hat:enterprise_linux:3::desktop |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
mod_sslRed Hat:enterprise_linux:3::desktop |
before 1:2.0.46-46.3.ent | 1:2.0.46-46.3.ent |
httpdRed Hat:enterprise_linux:3::es |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::es |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
httpd-develRed Hat:enterprise_linux:3::es |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
mod_sslRed Hat:enterprise_linux:3::es |
before 1:2.0.46-46.3.ent | 1:2.0.46-46.3.ent |
httpdRed Hat:enterprise_linux:3::ws |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
httpd-develRed Hat:enterprise_linux:3::ws |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
mod_sslRed Hat:enterprise_linux:3::ws |
before 1:2.0.46-46.3.ent | 1:2.0.46-46.3.ent |
httpdRed Hat:enterprise_linux:4::as |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-debuginfoRed Hat:enterprise_linux:4::as |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-develRed Hat:enterprise_linux:4::as |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-manualRed Hat:enterprise_linux:4::as |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-suexecRed Hat:enterprise_linux:4::as |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
mod_sslRed Hat:enterprise_linux:4::as |
before 1:2.0.52-12.2.ent | 1:2.0.52-12.2.ent |
httpdRed Hat:enterprise_linux:4::desktop |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-develRed Hat:enterprise_linux:4::desktop |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-manualRed Hat:enterprise_linux:4::desktop |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-suexecRed Hat:enterprise_linux:4::desktop |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
mod_sslRed Hat:enterprise_linux:4::desktop |
before 1:2.0.52-12.2.ent | 1:2.0.52-12.2.ent |
httpdRed Hat:enterprise_linux:4::es |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-debuginfoRed Hat:enterprise_linux:4::es |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-develRed Hat:enterprise_linux:4::es |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-manualRed Hat:enterprise_linux:4::es |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-suexecRed Hat:enterprise_linux:4::es |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
mod_sslRed Hat:enterprise_linux:4::es |
before 1:2.0.52-12.2.ent | 1:2.0.52-12.2.ent |
httpdRed Hat:enterprise_linux:4::ws |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-develRed Hat:enterprise_linux:4::ws |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-manualRed Hat:enterprise_linux:4::ws |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-suexecRed Hat:enterprise_linux:4::ws |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
mod_sslRed Hat:enterprise_linux:4::ws |
before 1:2.0.52-12.2.ent | 1:2.0.52-12.2.ent |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2005-2728 is a medium vulnerability (CVSS 5.0) in Apache Http Server, published August 29, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.0%, the 95th percentile. Fixed in apache2 2.0.54-5.
References
secunia.com/advisories/16705
securityfocus.com/bid/14660
redhat.com/support/errata/RHSA-2005-608.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10017
Show 73 moreShow less
support.avaya.com/elmodocs2/security/ASA-2006-081.htm
lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html
novell.com/linux/security/advisories/2005_51_apache2.html
ubuntu.com/usn/usn-177-1
gentoo.org/security/en/glsa/glsa-200508-15.xml
exchange.xforce.ibmcloud.com/vulnerabilities/22006
mandriva.com/security/advisories?name=MDKSA-2005:161
securityreason.com/securityalert/604
issues.apache.org/bugzilla/show_bug.cgi?id=29962
debian.org/security/2005/dsa-805
sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1
vupen.com/english/advisories/2006/0789
lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2005-2728
github.com/advisories/GHSA-5rc2-352q-326v
docs.bell-sw.com/security/cves/CVE-2005-2728
security-tracker.debian.org/tracker/CVE-2005-2728
access.redhat.com/errata/RHSA-2005:608
bugzilla.redhat.com/show_bug.cgi?id=167102
security.access.redhat.com/data/csaf/v2/advisories/2005/rhsa-2005_608.json
cve.org/CVERecord?id=CVE-2005-2700