Skip to content
CVE Tracker
Back

CVE-2011-0419

Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3…

Medium4.3EPSS 30.4%
Published
Updated
Reserved
Assigned by
certcc

Description

Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.

Scores

CVSS scores of CVE-2011-0419, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified2.0Medium4.3AV:N/AC:M/Au:N/C:N/I:N/A:P
EPSS (exploitation in 30 days)
30.4% · top 1.8% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

Affected products

  • n/a

    • affected n/a

References (58)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .