Every CVE Search/ Get API key

CVE-2011-3192

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2...

7.8 HighPublic exploitFix available

CVE-2011-3192 is a high vulnerability (CVSS 7.8) in Apache Http Server, published August 29, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 98.9%, the 99th percentile. Fixed in apache2 2.2.19-2.

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

Exploit likelihood

98.9%Up 8.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.8

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

Record
CVE-2011-3192
CVSS 2.0
7.8 HighAV:N/AC:L/Au:N/C:N/I:N/A:C
Weakness
CWE-400
Updated
2026-11-02
CVE List No score

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

Record
CVE-2011-3192
Updated
2026-11-02
EUVDEUVD-2011-3156 No score

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

Record
EUVD-2011-3156
Updated
2026-11-03
GitHub AdvisoriesGHSA-r3pv-69hm-fcjw No score

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2...

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

Record
GHSA-r3pv-69hm-fcjw
Weakness
CWE-400
Updated
2026-11-02
OSVBELL-CVE-2011-3192 7.8

CVE-2011-3192 does not affect BellSoft software

Record
BELL-CVE-2011-3192
CVSS 2.0
7.8 HighAV:N/AC:L/Au:N/C:N/I:N/A:C
Updated
2026-11-02
OSV No score

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

Record
CVE-2011-3192
Updated
2026-11-02
OSVDEBIAN-CVE-2011-3192 No score

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

Record
DEBIAN-CVE-2011-3192
Updated
2026-11-02
OSVopenSUSE-SU-2024:10268-1 No score

apache2-2.4.23-4.1 on GA media

These are all security issues fixed in the apache2-2.4.23-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10268-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Debian:12
 before 2.2.19-2
2.2.19-2
apache2
Debian:13
 before 2.2.19-2
2.2.19-2
apache2
Debian:14
 before 2.2.19-2
2.2.19-2
apache2
Debian:5.0
 before 2.2.9-10+lenny10, plus listed versions
2.2.9-10+lenny22.2.9-10+lenny32.2.9-10+lenny42.2.9-10+lenny52.2.9-10+lenny62.2.9-10+lenny72.2.9-10+lenny82.2.9-10+lenny9
2.2.9-10+lenny10
apache2
Debian:6.0
 before 2.2.16-6+squeeze2, plus listed versions
2.2.16-62.2.16-6+squeeze12.2.16-6+squeeze1~bpo50+12.2.16-6+squeeze2~bpo50+1
2.2.16-6+squeeze2
httpd
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
httpd-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
httpd-devel
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
httpd-manual
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
httpd-suexec
Red Hat:enterprise_linux:4::as
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
Show 85 moreShow less
Affected packages
PackageAffectedFixed
mod_ssl
Red Hat:enterprise_linux:4::as
 before 1:2.0.52-48.ent
1:2.0.52-48.ent
httpd
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
httpd-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
httpd-devel
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
httpd-manual
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
httpd-suexec
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
mod_ssl
Red Hat:enterprise_linux:4::desktop
 before 1:2.0.52-48.ent
1:2.0.52-48.ent
httpd
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
httpd-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
httpd-devel
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
httpd-manual
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
httpd-suexec
Red Hat:enterprise_linux:4::es
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
mod_ssl
Red Hat:enterprise_linux:4::es
 before 1:2.0.52-48.ent
1:2.0.52-48.ent
httpd
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
httpd-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
httpd-devel
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
httpd-manual
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
httpd-suexec
Red Hat:enterprise_linux:4::ws
 before 0:2.0.52-48.ent
0:2.0.52-48.ent
mod_ssl
Red Hat:enterprise_linux:4::ws
 before 1:2.0.52-48.ent
1:2.0.52-48.ent
httpd
Red Hat:enterprise_linux:5::client
 before 0:2.2.3-53.el5_7.1
0:2.2.3-53.el5_7.1
httpd-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:2.2.3-53.el5_7.1
0:2.2.3-53.el5_7.1
mod_ssl
Red Hat:enterprise_linux:5::client
 before 1:2.2.3-53.el5_7.1
1:2.2.3-53.el5_7.1
httpd
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.3-53.el5_7.1
0:2.2.3-53.el5_7.1
httpd-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.3-53.el5_7.1
0:2.2.3-53.el5_7.1
httpd-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.3-53.el5_7.1
0:2.2.3-53.el5_7.1
httpd-manual
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.3-53.el5_7.1
0:2.2.3-53.el5_7.1
httpd
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-53.el5_7.1
0:2.2.3-53.el5_7.1
httpd-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-53.el5_7.1
0:2.2.3-53.el5_7.1
httpd-devel
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-53.el5_7.1
0:2.2.3-53.el5_7.1
httpd-manual
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-53.el5_7.1
0:2.2.3-53.el5_7.1
mod_ssl
Red Hat:enterprise_linux:5::server
 before 1:2.2.3-53.el5_7.1
1:2.2.3-53.el5_7.1
httpd
Red Hat:enterprise_linux:6::server
 before 0:2.2.15-9.el6_1.2
0:2.2.15-9.el6_1.2
httpd-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:2.2.15-9.el6_1.2
0:2.2.15-9.el6_1.2
httpd-devel
Red Hat:enterprise_linux:6::server
 before 0:2.2.15-9.el6_1.2
0:2.2.15-9.el6_1.2
httpd-manual
Red Hat:enterprise_linux:6::server
 before 0:2.2.15-9.el6_1.2
0:2.2.15-9.el6_1.2
httpd-tools
Red Hat:enterprise_linux:6::server
 before 0:2.2.15-9.el6_1.2
0:2.2.15-9.el6_1.2
mod_ssl
Red Hat:enterprise_linux:6::server
 before 1:2.2.15-9.el6_1.2
1:2.2.15-9.el6_1.2
httpd
Red Hat:rhel_mission_critical:5.3
 before 0:2.2.3-22.el5_3.3
0:2.2.3-22.el5_3.3
httpd-debuginfo
Red Hat:rhel_mission_critical:5.3
 before 0:2.2.3-22.el5_3.3
0:2.2.3-22.el5_3.3
httpd-devel
Red Hat:rhel_mission_critical:5.3
 before 0:2.2.3-22.el5_3.3
0:2.2.3-22.el5_3.3
httpd-manual
Red Hat:rhel_mission_critical:5.3
 before 0:2.2.3-22.el5_3.3
0:2.2.3-22.el5_3.3
mod_ssl
Red Hat:rhel_mission_critical:5.3
 before 1:2.2.3-22.el5_3.3
1:2.2.3-22.el5_3.3
httpd
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-45.el5_6.2
0:2.2.3-45.el5_6.2
httpd-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-45.el5_6.2
0:2.2.3-45.el5_6.2
httpd-devel
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-45.el5_6.2
0:2.2.3-45.el5_6.2
httpd-manual
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-45.el5_6.2
0:2.2.3-45.el5_6.2
mod_ssl
Red Hat:enterprise_linux:5::server
 before 1:2.2.3-45.el5_6.2
1:2.2.3-45.el5_6.2
httpd
Red Hat:rhel_eus:6.0
 before 0:2.2.15-5.el6_0.1
0:2.2.15-5.el6_0.1
httpd-debuginfo
Red Hat:rhel_eus:6.0
 before 0:2.2.15-5.el6_0.1
0:2.2.15-5.el6_0.1
httpd-devel
Red Hat:rhel_eus:6.0
 before 0:2.2.15-5.el6_0.1
0:2.2.15-5.el6_0.1
httpd-manual
Red Hat:rhel_eus:6.0
 before 0:2.2.15-5.el6_0.1
0:2.2.15-5.el6_0.1
httpd-tools
Red Hat:rhel_eus:6.0
 before 0:2.2.15-5.el6_0.1
0:2.2.15-5.el6_0.1
mod_ssl
Red Hat:rhel_eus:6.0
 before 1:2.2.15-5.el6_0.1
1:2.2.15-5.el6_0.1
httpd
Red Hat:rhel_els:3::as
 before 0:2.0.46-78.ent
0:2.0.46-78.ent
httpd-debuginfo
Red Hat:rhel_els:3::as
 before 0:2.0.46-78.ent
0:2.0.46-78.ent
httpd-devel
Red Hat:rhel_els:3::as
 before 0:2.0.46-78.ent
0:2.0.46-78.ent
mod_ssl
Red Hat:rhel_els:3::as
 before 1:2.0.46-78.ent
1:2.0.46-78.ent
httpd
Red Hat:rhel_els:3::es
 before 0:2.0.46-78.ent
0:2.0.46-78.ent
httpd-debuginfo
Red Hat:rhel_els:3::es
 before 0:2.0.46-78.ent
0:2.0.46-78.ent
httpd-devel
Red Hat:rhel_els:3::es
 before 0:2.0.46-78.ent
0:2.0.46-78.ent
mod_ssl
Red Hat:rhel_els:3::es
 before 1:2.0.46-78.ent
1:2.0.46-78.ent
httpd22
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.17-16.ep5.el4
0:2.2.17-16.ep5.el4
httpd22-apr
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.17-16.ep5.el4
0:2.2.17-16.ep5.el4
httpd22-apr-devel
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.17-16.ep5.el4
0:2.2.17-16.ep5.el4
httpd22-apr-util
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.17-16.ep5.el4
0:2.2.17-16.ep5.el4
httpd22-apr-util-devel
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.17-16.ep5.el4
0:2.2.17-16.ep5.el4
httpd22-debuginfo
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.17-16.ep5.el4
0:2.2.17-16.ep5.el4
httpd22-devel
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.17-16.ep5.el4
0:2.2.17-16.ep5.el4
httpd22-manual
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.17-16.ep5.el4
0:2.2.17-16.ep5.el4
mod_ssl22
Red Hat:jboss_enterprise_web_server:1::el4
 before 1:2.2.17-16.ep5.el4
1:2.2.17-16.ep5.el4
httpd
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:2.2.17-14.1.ep5.el5
0:2.2.17-14.1.ep5.el5
httpd-devel
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:2.2.17-14.1.ep5.el5
0:2.2.17-14.1.ep5.el5
httpd-manual
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:2.2.17-14.1.ep5.el5
0:2.2.17-14.1.ep5.el5
mod_ssl
Red Hat:jboss_enterprise_web_server:1::el5
 before 1:2.2.17-14.1.ep5.el5
1:2.2.17-14.1.ep5.el5
httpd
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:2.2.17-13.2.ep5.el6
0:2.2.17-13.2.ep5.el6
httpd-devel
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:2.2.17-13.2.ep5.el6
0:2.2.17-13.2.ep5.el6
httpd-manual
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:2.2.17-13.2.ep5.el6
0:2.2.17-13.2.ep5.el6
httpd-tools
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:2.2.17-13.2.ep5.el6
0:2.2.17-13.2.ep5.el6
mod_ssl
Red Hat:jboss_enterprise_web_server:1::el6
 before 1:2.2.17-13.2.ep5.el6
1:2.2.17-13.2.ep5.el6
httpd
Red Hat:rhel_application_stack:2
 before 0:2.2.13-3.el5s2
0:2.2.13-3.el5s2
httpd-debuginfo
Red Hat:rhel_application_stack:2
 before 0:2.2.13-3.el5s2
0:2.2.13-3.el5s2
httpd-devel
Red Hat:rhel_application_stack:2
 before 0:2.2.13-3.el5s2
0:2.2.13-3.el5s2
httpd-manual
Red Hat:rhel_application_stack:2
 before 0:2.2.13-3.el5s2
0:2.2.13-3.el5s2
mod_ssl
Red Hat:rhel_application_stack:2
 before 1:2.2.13-3.el5s2
1:2.2.13-3.el5s2
apache2
openSUSE:Tumbleweed
 before 2.4.23-4.1
2.4.23-4.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBApache - Remote Memory Exhaustion (Denial of Service)2011-08-19
Exploit-DBApache - Denial of Service2011-12-09
MetasploitApache Range Header DoS (Apache Killer)2011-08-19
PoC in GitHubbluedragonsecurity/CVE-2011-3192-apache-exploit2026-05-14
PoC in GitHubfuturezayka/CVE-2011-31922023-09-16
PoC in GitHubstcmjp/cve-2011-31922020-04-09
PoC in GitHubtkisason/KillApachePy2011-10-26

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

References

Show 153 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open