Read the docs
TI-2011-02822 Aliases CVE-2011-3192GHSA-r3pv-69hm-fcjw

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x…

Priority HIGH 79CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Complete
Fix status
Partial Red Hat: 18 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

Why it matters now

EPSS 0.98945 99th percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by NVD and the CNA
Fix Partial Red Hat: 6 advisoriesRed Hat: 18 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*2.0.35 to before 2.0.65; 2.2.0 to before 2.2.20VulnerableApache
cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*11.3VulnerableopenSUSE
cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*11.4VulnerableopenSUSE
cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:-:*:*:*10 sp2VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:-:*:*:*10 sp3VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*10 sp4VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:-:*:*11 sp1VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:vmware:*:*11 sp1VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp3:*:*:*:*:*:*10 sp3VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*10 sp4VulnerableSUSE
  • cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions 2.0.35 to before 2.0.65; 2.2.0 to before 2.2.20 Vulnerable ·Apache
  • cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:* Versions 11.3 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:* Versions 11.4 Vulnerable ·openSUSE
  • cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:-:*:*:* Versions 10 sp2 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:-:*:*:* Versions 10 sp3 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:* Versions 10 sp4 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:-:*:* Versions 11 sp1 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:vmware:*:* Versions 11 sp1 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp3:*:*:*:*:*:* Versions 10 sp3 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:* Versions 10 sp4 Vulnerable ·SUSE
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp1:*:*:*:*:*:*11 sp1VulnerableSUSE
cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*8.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*10.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*10.10VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*11.04VulnerableCanonical
  • cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp1:*:*:*:*:*:* Versions 11 sp1 Vulnerable ·SUSE
  • cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:* Versions 8.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:* Versions 10.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:* Versions 10.10 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:* Versions 11.04 Vulnerable ·Canonical

Remediation

Red Hat 6 advisories

  • RHSA-2011:1369 Released 2011-10-13 · Red Hat rating Important
    httpd security update
    • Red Hat Application Stack v2 for Enterprise Linux (v.5) httpd-2.2.13-3.el5s2, httpd-2.2.13-3.el5s2.i386, httpd-devel-2.2.13-3.el5s2 +5
  • RHSA-2011:1330 Released 2011-09-21 · Red Hat rating Important
    JBoss Enterprise Web Server 1.0.2 security update
    • Red Hat JBoss Web Server 1.0
  • RHSA-2011:1329 Released 2011-09-21 · Red Hat rating Important
    httpd and httpd22 security update
    • Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server httpd-2.2.17-14.1.ep5.el5, httpd-2.2.17-14.1.ep5.el5.i386, httpd-devel-2.2.17-14.1.ep5.el5 +5
    • Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server httpd-2.2.17-13.2.ep5.el6, httpd-2.2.17-13.2.ep5.el6.i386, httpd-devel-2.2.17-13.2.ep5.el6 +7
    • Red Hat JBoss Web Server 1.0 for RHEL 4 AS httpd22-2.2.17-16.ep5.el4, httpd22-2.2.17-16.ep5.el4.i386, httpd22-apr-2.2.17-16.ep5.el4 +13
    • Red Hat JBoss Web Server 1.0 for RHEL 4 ES httpd22-2.2.17-16.ep5.el4, httpd22-2.2.17-16.ep5.el4.i386, httpd22-apr-2.2.17-16.ep5.el4 +13
Show 3 more Red Hat advisories
  • RHSA-2011:1300 Released 2011-09-15 · Red Hat rating Important
    httpd security update
    • Red Hat Enterprise Linux AS (v. 3 ELS) httpd-2.0.46-78.ent, httpd-2.0.46-78.ent.i386, httpd-devel-2.0.46-78.ent.i386 +1
    • Red Hat Enterprise Linux ES (v. 3 ELS) httpd-2.0.46-78.ent, httpd-2.0.46-78.ent.i386, httpd-devel-2.0.46-78.ent.i386 +1
  • RHSA-2011:1294 Released 2011-09-14 · Red Hat rating Important
    httpd security update
    • Red Hat Enterprise Linux (v. 5.6.z server) httpd-2.2.3-45.el5_6.2, httpd-2.2.3-45.el5_6.2.i386, httpd-2.2.3-45.el5_6.2.ia64 +13
    • Red Hat Enterprise Linux Long Life (v. 5.3 server) httpd-2.2.3-22.el5_3.3, httpd-2.2.3-22.el5_3.3.i386, httpd-2.2.3-22.el5_3.3.ia64 +9
    • Red Hat Enterprise Linux Server EUS (v. 6.0) httpd-2.2.15-5.el6_0.1, httpd-devel-2.2.15-5.el6_0.1, httpd-devel-2.2.15-5.el6_0.1.ppc +3
  • RHSA-2011:1245 Released 2011-08-31 · Red Hat rating Important
    httpd security update
    • RHEL Desktop Workstation (v. 5 client) httpd-2.2.3-53.el5_7.1, httpd-devel-2.2.3-53.el5_7.1, httpd-devel-2.2.3-53.el5_7.1.i386 +2
    • Red Hat Enterprise Linux (v. 5 server) httpd-2.2.3-53.el5_7.1, httpd-2.2.3-53.el5_7.1.i386, httpd-2.2.3-53.el5_7.1.ia64 +13
    • Red Hat Enterprise Linux AS version 4 httpd-2.0.52-48.ent, httpd-2.0.52-48.ent.i386, httpd-2.0.52-48.ent.ia64 +17
    • Red Hat Enterprise Linux Desktop (v. 5 client) httpd-2.2.3-53.el5_7.1, httpd-2.2.3-53.el5_7.1.i386, mod_ssl-1:2.2.3-53.el5_7.1 +1
    • Red Hat Enterprise Linux Desktop version 4 httpd-2.0.52-48.ent, httpd-2.0.52-48.ent.i386, httpd-devel-2.0.52-48.ent +7
    • Red Hat Enterprise Linux ES version 4 httpd-2.0.52-48.ent, httpd-2.0.52-48.ent.i386, httpd-2.0.52-48.ent.ia64 +12
    • Red Hat Enterprise Linux Server (v. 6) httpd-2.2.15-9.el6_1.2, httpd-devel-2.2.15-9.el6_1.2, httpd-devel-2.2.15-9.el6_1.2.ppc +3
    • Red Hat Enterprise Linux WS version 4 httpd-2.0.52-48.ent, httpd-2.0.52-48.ent.i386, httpd-2.0.52-48.ent.ia64 +12

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Directory Server 8AffectedNo fix yet
RHEL Desktop Workstation (v. 5 client)Fixed RHSA-2011:1245
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2011:1245
Red Hat Enterprise Linux (v. 5.6.z server)Fixed RHSA-2011:1294
Red Hat Enterprise Linux AS (v. 3 ELS)Fixed RHSA-2011:1300
Red Hat Enterprise Linux AS version 4Fixed RHSA-2011:1245
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2011:1245
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2011:1245
Red Hat Enterprise Linux ES (v. 3 ELS)Fixed RHSA-2011:1300
Red Hat Enterprise Linux ES version 4Fixed RHSA-2011:1245
Red Hat Enterprise Linux Long Life (v. 5.3 server)Fixed RHSA-2011:1294
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:1245
Red Hat Enterprise Linux Server EUS (v. 6.0)Fixed RHSA-2011:1294
Red Hat Enterprise Linux WS version 4Fixed RHSA-2011:1245
Red Hat JBoss Enterprise Web Server 1 for RHEL 5 ServerFixed RHSA-2011:1329
Red Hat JBoss Enterprise Web Server 1 for RHEL 6 ServerFixed RHSA-2011:1329
Red Hat JBoss Web Server 1.0Fixed RHSA-2011:1330
Red Hat JBoss Web Server 1.0 for RHEL 4 ASFixed RHSA-2011:1329
Red Hat JBoss Web Server 1.0 for RHEL 4 ESFixed RHSA-2011:1329

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-3192
  2. 2026-10-03 Alias added: GHSA-r3pv-69hm-fcjw

References

Exploit 4

Advisory 34

Other 26

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences