{"id":"CVE-2012-2138","aliases":["EUVD-2022-2101","GHSA-342c-f869-5m44"],"status":"published","title":"Apache Sling POST Servlets Denial of Service Vulnerability","description":"The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.14122,"percentile":0.96595,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-264","CWE-400"],"published":"2012-07-09T22:00:00Z","modified":"2026-06-16T23:41:04Z","exploits":[{"source":"exploitdb","id":"EDB-37487","title":"Apache Sling - Denial of Service","type":"dos","platform":"multiple","date":"2012-07-06","verified":true,"url":"https://www.exploit-db.com/exploits/37487"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.sling:org.apache.sling.servlets.post","fixed_in":["2.1.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.sling:org.apache.sling.servlets.post","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.sling:org.apache.sling.servlets.post","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2"}]}],"versions":["2.0.2-incubator","2.0.4-incubator","2.1.0"]}],"products":[{"vendor":"apache","product":"org.apache.sling.servlets.post"}],"references":[{"url":"https://issues.apache.org/jira/browse/SLING-2517","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1352865","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://mail-archives.apache.org/mod_mbox/www-announce/201207.mbox/%3CCAEWfVJ=PwoQmwJg0KmbrC17Gw51kgfKRsqgy=4RpMQsdGh0bVg%40mail.gmail.com%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-2138","tags":["advisory"]},{"url":"http://mail-archives.apache.org/mod_mbox/www-announce/201207.mbox/%3CCAEWfVJ=PwoQmwJg0KmbrC17Gw51kgfKRsqgy=4RpMQsdGh0bVg@mail.gmail.com%3E","tags":["web"]},{"url":"https://github.com/apache/sling-org-apache-sling-servlets-post/commit/0205892908d6ea755645be5fc16e9df53e2e7261","tags":["web"]},{"url":"https://github.com/advisories/GHSA-342c-f869-5m44"}],"sources":{"cve":[{"id":"CVE-2012-2138","description":"The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.","status":"published","published":"2012-07-09T22:00:00Z","modified":"2024-09-16T20:42:21.664Z","updated_at":"2026-11-02T14:34:50.263482Z"}],"euvd":[{"id":"EUVD-2022-2101","description":"The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.","status":"published","published":"2012-07-09T22:00:00Z","modified":"2024-09-16T20:42:21Z","updated_at":"2026-11-03T00:55:11.71058Z"}],"ghsa":[{"id":"GHSA-342c-f869-5m44","title":"Apache Sling POST Servlets Denial of Service Vulnerability","description":"The `@CopyFrom` operation in the POST servlet in the `org.apache.sling.servlets.post` bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.","status":"published","published":"2022-05-17T05:28:00Z","modified":"2023-08-29T22:53:52Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2012-2138","description":"The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.","status":"published","published":"2012-07-09T22:55:01.027Z","modified":"2026-06-16T23:41:04.057Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:14.774945Z"}],"osv":[{"id":"GHSA-342c-f869-5m44","title":"Apache Sling POST Servlets Denial of Service Vulnerability","description":"The `@CopyFrom` operation in the POST servlet in the `org.apache.sling.servlets.post` bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.","status":"published","published":"2022-05-17T05:28:00Z","modified":"2024-12-06T05:43:03.319734Z","cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:35.050232Z"}]}}