CVE-2009-1101
Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development...
5.0 Medium
Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to cause a denial of service (probably resource consumption) for a JAX-WS service endpoint via a connection without any data, which triggers a file descriptor "leak."
Exploit likelihood
3.58%Down 0.8 points since Feb 4, 2022
What each source reports
NVD Score used
Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to cause a denial of service (probably resource consumption) for a JAX-WS service endpoint via a connection without any data, which triggers a file descriptor "leak."
- Record
CVE-2009-1101- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to cause a denial of service (probably resource consumption) for a JAX-WS service endpoint via a connection without any data, which triggers a file descriptor "leak."
- Record
CVE-2009-1101- Updated
- 2026-11-02
EUVDEUVD-2009-1102 No score
Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to cause a denial of service (probably resource consumption) for a JAX-WS service endpoint via a connection without any data, which triggers a file descriptor "leak."
- Record
EUVD-2009-1102- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-84rr-q55c-9hm6 No score
Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development...
Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to cause a denial of service (probably resource consumption) for a JAX-WS service endpoint via a connection without any data, which triggers a file descriptor "leak."
- Record
GHSA-84rr-q55c-9hm6- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openjdk-6Debian:5.0 From an advisory covering 12 CVEs |
before 6b11-9.1+lenny2, plus listed versions 6b11-9.1 |
6b11-9.1+lenny2 |
java-1.6.0-openjdkRed Hat:enterprise_linux:5::client From an advisory covering 13 CVEs |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 13 CVEs |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-demoRed Hat:enterprise_linux:5::client From an advisory covering 13 CVEs |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-develRed Hat:enterprise_linux:5::client From an advisory covering 13 CVEs |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-javadocRed Hat:enterprise_linux:5::client From an advisory covering 13 CVEs |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-srcRed Hat:enterprise_linux:5::client From an advisory covering 13 CVEs |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdkRed Hat:enterprise_linux:5::server From an advisory covering 13 CVEs |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 13 CVEs |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-demoRed Hat:enterprise_linux:5::server From an advisory covering 13 CVEs |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
Show 71 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.6.0-openjdk-develRed Hat:enterprise_linux:5::server From an advisory covering 13 CVEs |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-javadocRed Hat:enterprise_linux:5::server From an advisory covering 13 CVEs |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-srcRed Hat:enterprise_linux:5::server From an advisory covering 13 CVEs |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-sunRed Hat:rhel_extras:4 From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sun-demoRed Hat:rhel_extras:4 From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sun-develRed Hat:rhel_extras:4 From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:4 From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:4 From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sun-srcRed Hat:rhel_extras:4 From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sunRed Hat:rhel_extras:5::client From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::client From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::client From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::client From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::client From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::client From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sunRed Hat:rhel_extras:5::server From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::server From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::server From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::server From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::server From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::server From an advisory covering 16 CVEs |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.5.0-ibmRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-develRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibmRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-accessibilityRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibmRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-accessibilityRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-develRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:4 From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibmRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::client From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::server From an advisory covering 14 CVEs |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibmRed Hat:network_satellite:5.3::el4 From an advisory covering 35 CVEs |
before 1:1.6.0.7-1jpp.3.el4 | 1:1.6.0.7-1jpp.3.el4 |
java-1.6.0-ibm-develRed Hat:network_satellite:5.3::el4 From an advisory covering 35 CVEs |
before 1:1.6.0.7-1jpp.3.el4 | 1:1.6.0.7-1jpp.3.el4 |
java-1.6.0-ibmRed Hat:network_satellite:5.3::el5 From an advisory covering 35 CVEs |
before 1:1.6.0.7-1jpp.2.el5 | 1:1.6.0.7-1jpp.2.el5 |
java-1.6.0-ibm-develRed Hat:network_satellite:5.3::el5 From an advisory covering 35 CVEs |
before 1:1.6.0.7-1jpp.2.el5 | 1:1.6.0.7-1jpp.2.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-1101 is a medium vulnerability (CVSS 5.0) in Sun Jdk, published March 25, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.58%, the 89th percentile. No source names a fixed version.
References
lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html
mandriva.com/security/advisories?name=MDVSA-2009:137
secunia.com/advisories/34632
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133
Show 194 moreShow less
sunsolve.sun.com/search/document.do?assetkey=1-66-254609-1
security.gentoo.org/glsa/glsa-200911-02.xml
redhat.com/support/errata/RHSA-2009-1038.html
rhn.redhat.com/errata/RHSA-2009-1198.html
vmware.com/security/advisories/VMSA-2009-0016.html
marc.info?l=bugtraq&m=124344236532162&w=2
securitytracker.com/id?1021918
vupen.com/english/advisories/2009/1426
securityfocus.com/archive/1/507985/100/0/threaded
oracle.com/technetwork/topics/security/cpujul2009-091332.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6412
ubuntu.com/usn/usn-748-1
debian.org/security/2009/dsa-1769
support.avaya.com/elmodocs2/security/ASA-2009-108.htm
nvd.nist.gov/vuln/detail/CVE-2009-1101
github.com/advisories/GHSA-84rr-q55c-9hm6
access.redhat.com/errata/RHSA-2009:0377
blogs.sun.com/security/entry/advance_notification_of_security_updates4
bugzilla.redhat.com/show_bug.cgi?id=395481
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0377.json
cve.org/CVERecord?id=CVE-2006-2426
ibm.com/developerworks/java/jdk/alerts
This page doesn't list everything
Left out here: 13 references. The JSON record has them.