CVE-2007-0086
** DISPUTED ** The Apache HTTP Server, when accessed through a TCP connection with a large...
The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
Exploit likelihood
What each source reports
NVD Score used
The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
- Record
CVE-2007-0086- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE ListNo score
The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
- Record
CVE-2007-0086- Updated
- 2026-11-02
EUVDEUVD-2007-0090No score
The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
- Record
EUVD-2007-0090- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vfvv-gfh6-h8qcNo score
** DISPUTED ** The Apache HTTP Server, when accessed through a TCP connection with a large...
** DISPUTED ** The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal.
- Record
GHSA-vfvv-gfh6-h8qc- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVNo score
The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
- Record
CVE-2007-0086- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-0086No score
The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
- Record
DEBIAN-CVE-2007-0086- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2007-0086No score
CVE-2007-0086 in apache2 - Patched by Root
Root has patched CVE-2007-0086 in the apache2 package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2007-0086- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache2Debian:12 | All versions, plus listed versions 2.4.57-22.4.57-32.4.58-12.4.59-12.4.59-1~deb10u1 Show 45 moreShow less2.4.59-1~deb11u12.4.59-1~deb12u12.4.59-22.4.60-12.4.61-12.4.61-1~deb11u12.4.61-1~deb12u12.4.62-12.4.62-1~deb11u12.4.62-1~deb11u22.4.62-1~deb12u12.4.62-1~deb12u22.4.62-22.4.62-32.4.62-42.4.62-52.4.62-62.4.63-12.4.64-12.4.65-12.4.65-1~deb11u12.4.65-1~deb12u12.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u12.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-12.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u12.4.67-1~deb12u22.4.67-1~deb12u32.4.67-1~deb13u1 | None known |
apache2Debian:13 | All versions, plus listed versions 2.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u1 Show 27 moreShow less2.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-12.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u12.4.67-1~deb12u22.4.67-1~deb12u32.4.67-1~deb13u12.4.67-1~deb13u22.4.67-1~deb13u32.4.67-22.4.68-12.4.68-1~deb12u12.4.68-1~deb13u12.4.68-22.4.69-12.4.69-1~deb13u1 | None known |
apache2Debian:14 | All versions, plus listed versions 2.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u1 Show 27 moreShow less2.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-12.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u12.4.67-1~deb12u22.4.67-1~deb12u32.4.67-1~deb13u12.4.67-1~deb13u22.4.67-1~deb13u32.4.67-22.4.68-12.4.68-1~deb12u12.4.68-1~deb13u12.4.68-22.4.69-12.4.69-1~deb13u1 | None known |
apache2Root:Debian:12 | before 2.4.68-1~deb12u1.aikido.14 | 2.4.68-1~deb12u1.aikido.142.4.68-1~deb12u1.aikido.15 |
rootio-apache2Root:Debian:12 | before 2.4.68-1~deb12u1.aikido.14 | 2.4.68-1~deb12u1.aikido.142.4.68-1~deb12u1.aikido.15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| affected, aliases, references | ||
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-0086 is a high vulnerability (CVSS 7.8) in Apache Http Server, published January 5, 2007. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 10.2%, the 95th percentile. Fixed in apache2 2.4.68-1~deb12u1.aikido.14.
References
osvdb.org/33456
securityfocus.com/archive/1/455920/100/0/threaded
nvd.nist.gov/vuln/detail/CVE-2007-0086
github.com/advisories/GHSA-vfvv-gfh6-h8qc
security-tracker.debian.org/tracker/CVE-2007-0086
Left out here: 9 versions. The JSON record has them.