CVE-2007-3303
Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial...
Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large number of worker processes. NOTE: This might be an inherent design limitation of Apache with respect to worker processes in hosted environments.
Exploit likelihood
What each source reports
NVD Score used
Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large number of worker processes. NOTE: This might be an inherent design limitation of Apache with respect to worker processes in hosted environments.
- Record
CVE-2007-3303- CVSS 2.0
- 4.9 Medium
AV:L/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large number of worker processes. NOTE: This might be an inherent design limitation of Apache with respect to worker processes in hosted environments.
- Record
CVE-2007-3303- Updated
- 2026-11-02
EUVDEUVD-2007-3293 No score
Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large number of worker processes. NOTE: This might be an inherent design limitation of Apache with respect to worker processes in hosted environments.
- Record
EUVD-2007-3293- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hxj5-ccfq-hvjx No score
Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial...
Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large number of worker processes. NOTE: This might be an inherent design limitation of Apache with respect to worker processes in hosted environments.
- Record
GHSA-hxj5-ccfq-hvjx- Weakness
- CWE-94
- Updated
- 2026-11-02
OSV No score
Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large number of worker processes. NOTE: This might be an inherent design limitation of Apache with respect to worker processes in hosted environments.
- Record
CVE-2007-3303- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-3303 No score
Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large number of worker processes. NOTE: This might be an inherent design limitation of Apache with respect to worker processes in hosted environments.
- Record
DEBIAN-CVE-2007-3303- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache2Debian:12 |
All versions, plus listed versions 2.4.57-22.4.57-32.4.58-12.4.59-12.4.59-1~deb10u1 Show 45 moreShow less2.4.59-1~deb11u12.4.59-1~deb12u12.4.59-22.4.60-12.4.61-12.4.61-1~deb11u12.4.61-1~deb12u12.4.62-12.4.62-1~deb11u12.4.62-1~deb11u22.4.62-1~deb12u12.4.62-1~deb12u22.4.62-22.4.62-32.4.62-42.4.62-52.4.62-62.4.63-12.4.64-12.4.65-12.4.65-1~deb11u12.4.65-1~deb12u12.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u12.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-12.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u12.4.67-1~deb12u22.4.67-1~deb12u32.4.67-1~deb13u1 |
None known |
apache2Debian:13 |
All versions, plus listed versions 2.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u1 Show 27 moreShow less2.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-12.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u12.4.67-1~deb12u22.4.67-1~deb12u32.4.67-1~deb13u12.4.67-1~deb13u22.4.67-1~deb13u32.4.67-22.4.68-12.4.68-1~deb12u12.4.68-1~deb13u12.4.68-22.4.69-12.4.69-1~deb13u1 |
None known |
apache2Debian:14 |
All versions, plus listed versions 2.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u1 Show 27 moreShow less2.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-12.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u12.4.67-1~deb12u22.4.67-1~deb12u32.4.67-1~deb13u12.4.67-1~deb13u22.4.67-1~deb13u32.4.67-22.4.68-12.4.68-1~deb12u12.4.68-1~deb13u12.4.68-22.4.69-12.4.69-1~deb13u1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| affected, aliases, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3303 is a medium vulnerability (CVSS 4.9) in Apache Http Server, published June 20, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. No source names a fixed version.
References
security.psnc.pl/files/apache_report.pdf
osvdb.org/37050
securityfocus.com/archive/1/469899/100/0/threaded
securityreason.com/securityalert/2814
nvd.nist.gov/vuln/detail/CVE-2007-3303
github.com/advisories/GHSA-hxj5-ccfq-hvjx
security-tracker.debian.org/tracker/CVE-2007-3303
Left out here: 9 versions. The JSON record has them.