CVE-2007-0086
** DISPUTED ** The Apache HTTP Server, when accessed through a TCP connection with a large...
CVE-2007-0086 is a high vulnerability (CVSS 7.8) in Apache Http Server, published January 5, 2007. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 10.2%, the 95th percentile. Fixed in apache2 2.4.68-1~deb12u1.aikido.14.
The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
Exploit likelihood
What each source reports
NVD Score used
The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
- Record
CVE-2007-0086- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
- Record
CVE-2007-0086- Updated
- 2026-11-02
EUVDEUVD-2007-0090 No score
The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
- Record
EUVD-2007-0090- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vfvv-gfh6-h8qc No score
** DISPUTED ** The Apache HTTP Server, when accessed through a TCP connection with a large...
** DISPUTED ** The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal.
- Record
GHSA-vfvv-gfh6-h8qc- Weakness
- CWE-400
- Updated
- 2026-11-02
OSV No score
The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
- Record
CVE-2007-0086- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-0086 No score
The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
- Record
DEBIAN-CVE-2007-0086- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2007-0086 No score
CVE-2007-0086 in apache2 - Patched by Root
Root has patched CVE-2007-0086 in the apache2 package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2007-0086- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache2Debian:12 |
All versions, plus listed versions 2.4.57-22.4.57-32.4.58-12.4.59-12.4.59-1~deb10u1 Show 45 moreShow less2.4.59-1~deb11u12.4.59-1~deb12u12.4.59-22.4.60-12.4.61-12.4.61-1~deb11u12.4.61-1~deb12u12.4.62-12.4.62-1~deb11u12.4.62-1~deb11u22.4.62-1~deb12u12.4.62-1~deb12u22.4.62-22.4.62-32.4.62-42.4.62-52.4.62-62.4.63-12.4.64-12.4.65-12.4.65-1~deb11u12.4.65-1~deb12u12.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u12.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-12.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u12.4.67-1~deb12u22.4.67-1~deb12u32.4.67-1~deb13u1 |
None known |
apache2Debian:13 |
All versions, plus listed versions 2.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u1 Show 27 moreShow less2.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-12.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u12.4.67-1~deb12u22.4.67-1~deb12u32.4.67-1~deb13u12.4.67-1~deb13u22.4.67-1~deb13u32.4.67-22.4.68-12.4.68-1~deb12u12.4.68-1~deb13u12.4.68-22.4.69-12.4.69-1~deb13u1 |
None known |
apache2Debian:14 |
All versions, plus listed versions 2.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u1 Show 27 moreShow less2.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-12.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u12.4.67-1~deb12u22.4.67-1~deb12u32.4.67-1~deb13u12.4.67-1~deb13u22.4.67-1~deb13u32.4.67-22.4.68-12.4.68-1~deb12u12.4.68-1~deb13u12.4.68-22.4.69-12.4.69-1~deb13u1 |
None known |
apache2Root:Debian:12 |
before 2.4.68-1~deb12u1.aikido.14 | 2.4.68-1~deb12u1.aikido.142.4.68-1~deb12u1.aikido.15 |
rootio-apache2Root:Debian:12 |
before 2.4.68-1~deb12u1.aikido.14 | 2.4.68-1~deb12u1.aikido.142.4.68-1~deb12u1.aikido.15 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | affected, aliases, references | |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
osvdb.org/33456
securityfocus.com/archive/1/455920/100/0/threaded
nvd.nist.gov/vuln/detail/CVE-2007-0086
github.com/advisories/GHSA-vfvv-gfh6-h8qc
security-tracker.debian.org/tracker/CVE-2007-0086
Left out here: 9 versions. The JSON record has them.