Every CVE Search/ Get API key

CVE-2009-1890

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP...

7.1 HighFix available

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.

Exploit likelihood

16.2%Up 8.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.1

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.

Record
CVE-2009-1890
CVSS 2.0
7.1 HighAV:N/AC:M/Au:N/C:N/I:N/A:C
Weakness
CWE-400
Updated
2026-11-02
CVE List No score

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.

Record
CVE-2009-1890
Updated
2026-11-02
EUVDEUVD-2009-1885 No score

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.

Record
EUVD-2009-1885
Updated
2026-11-03
GitHub AdvisoriesGHSA-wvqw-w5hq-v4m4 No score

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP...

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.

Record
GHSA-wvqw-w5hq-v4m4
Weakness
CWE-400
Updated
2026-11-02
OSVAZL-9785 No score

CVE-2009-1890 for package httpd is not applicable

This CVE either no longer is or was never applicable.

Record
AZL-9785
Updated
2026-11-02
OSV No score

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.

Record
CVE-2009-1890
Updated
2026-11-02
OSVDEBIAN-CVE-2009-1890 No score

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.

Record
DEBIAN-CVE-2009-1890
Updated
2026-11-02
OSVopenSUSE-SU-2024:10268-1 No score

apache2-2.4.23-4.1 on GA media

These are all security issues fixed in the apache2-2.4.23-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10268-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Debian:12
 before 2.2.11-7
2.2.11-7
apache2
Debian:13
 before 2.2.11-7
2.2.11-7
apache2
Debian:14
 before 2.2.11-7
2.2.11-7
apache2
Debian:4.0
 before 2.2.3-4+etch9, plus listed versions
2.2.3-42.2.3-4+etch12.2.3-4+etch22.2.3-4+etch32.2.3-4+etch42.2.3-4+etch52.2.3-4+etch62.2.3-4+etch8
2.2.3-4+etch9
apache2
Debian:5.0
 before 2.2.9-10+lenny4, plus listed versions
2.2.9-10+lenny22.2.9-10+lenny3
2.2.9-10+lenny4
httpd
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.3-22.el5_3.2
0:2.2.3-22.el5_3.2
httpd-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.3-22.el5_3.2
0:2.2.3-22.el5_3.2
httpd-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.3-22.el5_3.2
0:2.2.3-22.el5_3.2
httpd-manual
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.3-22.el5_3.2
0:2.2.3-22.el5_3.2
httpd
Red Hat:enterprise_linux:5::client
 before 0:2.2.3-22.el5_3.2
0:2.2.3-22.el5_3.2
Show 25 moreShow less
Affected packages
PackageAffectedFixed
httpd-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:2.2.3-22.el5_3.2
0:2.2.3-22.el5_3.2
mod_ssl
Red Hat:enterprise_linux:5::client
 before 1:2.2.3-22.el5_3.2
1:2.2.3-22.el5_3.2
httpd
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-22.el5_3.2
0:2.2.3-22.el5_3.2
httpd-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-22.el5_3.2
0:2.2.3-22.el5_3.2
httpd-devel
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-22.el5_3.2
0:2.2.3-22.el5_3.2
httpd-manual
Red Hat:enterprise_linux:5::server
 before 0:2.2.3-22.el5_3.2
0:2.2.3-22.el5_3.2
mod_ssl
Red Hat:enterprise_linux:5::server
 before 1:2.2.3-22.el5_3.2
1:2.2.3-22.el5_3.2
httpd
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:2.2.10-10.ep5.el5
0:2.2.10-10.ep5.el5
httpd-devel
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:2.2.10-10.ep5.el5
0:2.2.10-10.ep5.el5
httpd-manual
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:2.2.10-10.ep5.el5
0:2.2.10-10.ep5.el5
mod_ssl
Red Hat:jboss_enterprise_web_server:1::el5
 before 1:2.2.10-10.ep5.el5
1:2.2.10-10.ep5.el5
httpd
Red Hat:rhel_application_stack:2
 before 0:2.2.11-3.el5s2
0:2.2.11-3.el5s2
httpd-debuginfo
Red Hat:rhel_application_stack:2
 before 0:2.2.11-3.el5s2
0:2.2.11-3.el5s2
httpd-devel
Red Hat:rhel_application_stack:2
 before 0:2.2.11-3.el5s2
0:2.2.11-3.el5s2
httpd-manual
Red Hat:rhel_application_stack:2
 before 0:2.2.11-3.el5s2
0:2.2.11-3.el5s2
mod_ssl
Red Hat:rhel_application_stack:2
 before 1:2.2.11-3.el5s2
1:2.2.11-3.el5s2
httpd22
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.10-23.1.ep5.el4
0:2.2.10-23.1.ep5.el4
httpd22-apr
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.10-23.1.ep5.el4
0:2.2.10-23.1.ep5.el4
httpd22-apr-devel
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.10-23.1.ep5.el4
0:2.2.10-23.1.ep5.el4
httpd22-apr-util
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.10-23.1.ep5.el4
0:2.2.10-23.1.ep5.el4
httpd22-apr-util-devel
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.10-23.1.ep5.el4
0:2.2.10-23.1.ep5.el4
httpd22-debuginfo
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.10-23.1.ep5.el4
0:2.2.10-23.1.ep5.el4
httpd22-devel
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.10-23.1.ep5.el4
0:2.2.10-23.1.ep5.el4
mod_ssl22
Red Hat:jboss_enterprise_web_server:1::el4
 before 1:2.2.10-23.1.ep5.el4
1:2.2.10-23.1.ep5.el4
apache2
openSUSE:Tumbleweed
 before 2.4.23-4.1
2.4.23-4.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-1890 is a high vulnerability (CVSS 7.1) in Apache Http Server, published July 5, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.2%, the 96th percentile. Fixed in apache2 2.2.11-7.

References

Show 136 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open