Search for vulnerabilities
Vulnerability details: VCID-8adb-pxka-97gq
Vulnerability ID VCID-8adb-pxka-97gq
Aliases CVE-2011-0419
Summary A flaw was found in the apr_fnmatch() function of the bundled APR library. Where mod_autoindex is enabled, and a directory indexed by mod_autoindex contained files with sufficiently long names, a remote attacker could send a carefully crafted request which would cause excessive CPU usage. This could be used in a denial of service attack. Workaround: Setting the 'IgnoreClient' option to the 'IndexOptions' directive disables processing of the client-supplied request query arguments, preventing this attack. Resolution: Update APR to release 1.4.5 (bundled with httpd 2.2.19) or release 0.9.20 (bundled with httpd 2.0.65)
Status Published
Exploitability 2.0
Weighted Severity 4.8
Risk 9.6
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.46642 https://api.first.org/data/v1/epss?cve=CVE-2011-0419
epss 0.46642 https://api.first.org/data/v1/epss?cve=CVE-2011-0419
epss 0.54356 https://api.first.org/data/v1/epss?cve=CVE-2011-0419
epss 0.54356 https://api.first.org/data/v1/epss?cve=CVE-2011-0419
epss 0.54356 https://api.first.org/data/v1/epss?cve=CVE-2011-0419
epss 0.54356 https://api.first.org/data/v1/epss?cve=CVE-2011-0419
epss 0.54356 https://api.first.org/data/v1/epss?cve=CVE-2011-0419
epss 0.54356 https://api.first.org/data/v1/epss?cve=CVE-2011-0419
epss 0.54356 https://api.first.org/data/v1/epss?cve=CVE-2011-0419
epss 0.54356 https://api.first.org/data/v1/epss?cve=CVE-2011-0419
epss 0.54356 https://api.first.org/data/v1/epss?cve=CVE-2011-0419
epss 0.54356 https://api.first.org/data/v1/epss?cve=CVE-2011-0419
epss 0.54356 https://api.first.org/data/v1/epss?cve=CVE-2011-0419
apache_httpd moderate https://httpd.apache.org/security/json/CVE-2011-0419.json
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-0419.json
https://api.first.org/data/v1/epss?cve=CVE-2011-0419
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0419
703390 https://bugzilla.redhat.com/show_bug.cgi?id=703390
CVE-2011-0419 https://httpd.apache.org/security/json/CVE-2011-0419.json
CVE-2011-0419;OSVDB-73383 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/dos/35738.php
CVE-2011-0419;OSVDB-73383 Exploit https://www.securityfocus.com/bid/47820/info
RHSA-2011:0507 https://access.redhat.com/errata/RHSA-2011:0507
USN-1134-1 https://usn.ubuntu.com/1134-1/
Data source Exploit-DB
Date added May 12, 2011
Description Apache 1.4/2.2.x - APR 'apr_fnmatch()' Denial of Service
Ransomware campaign use Known
Source publication date May 12, 2011
Exploit type dos
Platform linux
Source update date Jan. 9, 2015
Source URL https://www.securityfocus.com/bid/47820/info
Exploit Prediction Scoring System (EPSS)
Percentile 0.97593
EPSS Score 0.46642
Published At Aug. 3, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:28:53.504424+00:00 Apache HTTPD Importer Import https://httpd.apache.org/security/json/CVE-2011-0419.json 37.0.0