{"id":"CVE-2014-3523","aliases":["EUVD-2014-3522","GHSA-jvhm-2h34-2h38","openSUSE-SU-2024:10268-1"],"status":"published","title":"Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the...","description":"Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted requests.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.16805,"percentile":0.97058,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-399"],"published":"2014-07-20T10:00:00Z","modified":"2026-06-17T00:08:23Z","affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-4.1"}]}],"bundled":48}],"products":[{"vendor":"apache","product":"http_server"}],"references":[{"url":"http://svn.apache.org/viewvc/httpd/httpd/trunk/server/mpm/winnt/child.c?r1=1608785\u0026r2=1610652\u0026diff_format=h","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://marc.info/?l=bugtraq\u0026m=144050155601375\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred"]},{"url":"http://httpd.apache.org/security/vulnerabilities_24.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=143748090628601\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred"]},{"url":"http://svn.apache.org/viewvc/httpd/httpd/trunk/server/mpm/winnt/child.c","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2957.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.securityfocus.com/bid/68747","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3523"},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-jvhm-2h34-2h38"},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4979","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3523","description":"Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted requests.","status":"published","published":"2014-07-20T10:00:00Z","modified":"2024-08-06T10:50:16.34Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2014-3522","description":"Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted requests.","status":"published","published":"2014-07-20T10:00:00Z","modified":"2024-08-06T10:50:16Z","updated_at":"2026-11-03T01:57:10.446744Z"}],"ghsa":[{"id":"GHSA-jvhm-2h34-2h38","title":"Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the...","description":"Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted requests.","status":"published","published":"2022-05-13T01:09:46Z","modified":"2025-04-12T12:37:01Z","updated_at":"2026-11-02T15:01:18.41255Z"}],"nvd":[{"id":"CVE-2014-3523","description":"Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted requests.","status":"published","published":"2014-07-20T11:12:50.387Z","modified":"2026-06-17T00:08:23.047Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:02:54.827864Z"}],"osv":[{"id":"openSUSE-SU-2024:10268-1","title":"apache2-2.4.23-4.1 on GA media","description":"These are all security issues fixed in the apache2-2.4.23-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:25:01.364403Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}