Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the…
Priority MEDIUM 44CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-770.
Summary
Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.
Why it matters now
EPSS 0.30406 98th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Red Hat: 3 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:portable_runtime:*:*:*:*:*:*:*:* | before 1.4.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | 2.0.0 – 2.0.65; 2.2.0 – 2.2.18 | Vulnerable | Apache |
| cpe:2.3:o:apple:mac_os_x:10.6.0:*:*:*:*:*:*:* | 10.6.0 | Vulnerable | Apple |
| cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* | all versions | Vulnerable | FreeBSD |
| cpe:2.3:o:google:android:*:*:*:*:*:*:*:* | all versions | Vulnerable | |
| cpe:2.3:o:netbsd:netbsd:5.1:*:*:*:*:*:*:* | 5.1 | Vulnerable | NetBSD |
| cpe:2.3:o:openbsd:openbsd:4.8:*:*:*:*:*:*:* | 4.8 | Vulnerable | OpenBSD |
| cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:* | 10 | Vulnerable | Oracle |
| cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Debian |
- cpe:2.3:a:apache:portable_runtime:*:*:*:*:*:*:*:* Versions before 1.4.3 Vulnerable ·Apache
- cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions 2.0.0 – 2.0.65; 2.2.0 – 2.2.18 Vulnerable ·Apache
- cpe:2.3:o:apple:mac_os_x:10.6.0:*:*:*:*:*:*:* Versions 10.6.0 Vulnerable ·Apple
- cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·FreeBSD
- cpe:2.3:o:google:android:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Google
- cpe:2.3:o:netbsd:netbsd:5.1:*:*:*:*:*:*:* Versions 5.1 Vulnerable ·NetBSD
- cpe:2.3:o:openbsd:openbsd:4.8:*:*:*:*:*:*:* Versions 4.8 Vulnerable ·OpenBSD
- cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:* Versions 10 Vulnerable ·Oracle
- cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Debian
Remediation
Red Hat 3 advisories
- RHSA-2011:0897 Released 2011-06-22 · Red Hat rating ModerateJBoss Enterprise Web Server 1.0.2 update
- Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server ant-1.7.1-13.jdk6.ep5.el5, ant-antlr-1.7.1-13.jdk6.ep5.el5, ant-apache-bcel-1.7.1-13.jdk6.ep5.el5 +47
- Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server ant-1.7.1-14.ep5.el6, ant-antlr-1.7.1-14.ep5.el6, ant-apache-bcel-1.7.1-14.ep5.el6 +47
- Red Hat JBoss Web Server 1.0 for RHEL 4 AS ant-1.7.1-13.jdk6.ep5.el4, antlr-2.7.7-7.ep5.el4, bcel-5.2-8.1.ep5.el4 +47
- Red Hat JBoss Web Server 1.0 for RHEL 4 ES ant-1.7.1-13.jdk6.ep5.el4, antlr-2.7.7-7.ep5.el4, bcel-5.2-8.1.ep5.el4 +47
- RHSA-2011:0896 Released 2011-06-22 · Red Hat rating ModerateJBoss Enterprise Web Server 1.0.2 update
- Red Hat JBoss Web Server 1.0
- RHSA-2011:0507 Released 2011-05-11 · Red Hat rating Moderateapr security update
- Red Hat Enterprise Linux (v. 5 server) apr-1.2.7-11.el5_6.4, apr-1.2.7-11.el5_6.4.i386, apr-1.2.7-11.el5_6.4.ia64 +9
- Red Hat Enterprise Linux AS version 4 apr-0.9.4-25.el4, apr-0.9.4-25.el4.i386, apr-0.9.4-25.el4.ia64 +5
- Red Hat Enterprise Linux Desktop (v. 5 client) apr-1.2.7-11.el5_6.4, apr-1.2.7-11.el5_6.4.i386, apr-docs-1.2.7-11.el5_6.4 +1
- Red Hat Enterprise Linux Desktop (v. 6) apr-1.3.9-3.el6_0.1
- Red Hat Enterprise Linux Desktop Optional (v. 6) apr-1.3.9-3.el6_0.1, apr-devel-1.3.9-3.el6_0.1
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) apr-1.2.7-11.el5_6.4, apr-devel-1.2.7-11.el5_6.4, apr-devel-1.2.7-11.el5_6.4.i386
- Red Hat Enterprise Linux Desktop version 4 apr-0.9.4-25.el4, apr-0.9.4-25.el4.i386, apr-devel-0.9.4-25.el4 +1
- Red Hat Enterprise Linux ES version 4 apr-0.9.4-25.el4, apr-0.9.4-25.el4.i386, apr-0.9.4-25.el4.ia64 +3
- Red Hat Enterprise Linux HPC Node (v. 6) apr-1.3.9-3.el6_0.1
- Red Hat Enterprise Linux HPC Node Optional (v. 6) apr-1.3.9-3.el6_0.1, apr-devel-1.3.9-3.el6_0.1
- Red Hat Enterprise Linux Server (v. 6) apr-1.3.9-3.el6_0.1, apr-1.3.9-3.el6_0.1.ppc, apr-devel-1.3.9-3.el6_0.1 +1
- Red Hat Enterprise Linux WS version 4 apr-0.9.4-25.el4, apr-0.9.4-25.el4.i386, apr-0.9.4-25.el4.ia64 +3
- Red Hat Enterprise Linux Workstation (v. 6) apr-1.3.9-3.el6_0.1, apr-devel-1.3.9-3.el6_0.1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2011:0507 |
| Red Hat Enterprise Linux AS version 4 | Fixed | RHSA-2011:0507 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2011:0507 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2011:0507 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2011:0507 |
| Red Hat Enterprise Linux Desktop Workstation (v. 5 client) | Fixed | RHSA-2011:0507 |
| Red Hat Enterprise Linux Desktop version 4 | Fixed | RHSA-2011:0507 |
| Red Hat Enterprise Linux ES version 4 | Fixed | RHSA-2011:0507 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2011:0507 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2011:0507 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2011:0507 |
| Red Hat Enterprise Linux WS version 4 | Fixed | RHSA-2011:0507 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2011:0507 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1.0 | Fixed | RHSA-2011:0896 |
| Red Hat JBoss Web Server 1.0 for RHEL 4 AS | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1.0 for RHEL 4 ES | Fixed | RHSA-2011:0897 |
Timeline
- 2026-10-02 Threatist record created from CVE-2011-0419
- 2026-10-03 Alias added: GHSA-hx32-x2cq-h45v
References
Patch 7
- http://svn.apache.org/viewvc?view=revision&revision=1098188
- http://www.apache.org/dist/apr/Announcement1.x.html
- http://svn.apache.org/viewvc?view=revision&revision=1098799
- http://svn.apache.org/viewvc/apr/apr/branches/1.4.x/strings/apr_fnmatch.c?r1=731029&r2=1098902
- https://bugzilla.redhat.com/show_bug.cgi?id=703390
- http://www.apache.org/dist/httpd/Announcement2.2.html
- http://cxib.net/stuff/apache.fnmatch.phps
Advisory 42
- HPSBUX02707
- SSRT100966
- [dev] 20110511 Re: Apache Portable Runtime 1.4.4 [...] Released
- HPSBUX02702
- SSRT100619
- oval:org.mitre.oval:def:14804
- http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
- http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/fnmatch.c#rev1.22
- http://cxib.net/stuff/apr_fnmatch.txts
- oval:org.mitre.oval:def:14638
- APPLE-SA-2011-10-12-3
- http://httpd.apache.org/security/vulnerabilities_22.html
- DSA-2237
- RHSA-2011:0897
- http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
- RHSA-2011:0896
- http://support.apple.com/kb/HT5002
- MDVSA-2011:084
- [dev] 20110510 Re: Apache Portable Runtime 1.4.4 [...] Released
- MDVSA-2013:150
- RHSA-2011:0507
- SUSE-SU-2011:1229
- [dev] 20110510 Re: fnmatch rewrite in apr, apr 1.4.3
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1888194 [7/13] - /httpd/site/trunk/content/security/json/
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/
- [httpd-cvs] 20210330 svn commit: r1073139 [7/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
- [httpd-cvs] 20210330 svn commit: r1073149 [8/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/
- [httpd-cvs] 20210330 svn commit: r1888222 - in /httpd/site/trunk/content/security/json: CVE-2010-2068.json CVE-2010-2791.json CVE-2011-0419.json CVE-2011-3368.json
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
Sources
- CVE-2011-0419 · CVE Program
- CVE-2011-0419 · NVD
- FIRST EPSS
- GHSA-hx32-x2cq-h45v · GitHub Advisory Database · CC BY 4.0
- CVE-2011-0419 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences