Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Apache HTTP Server cache can crash with empty Cache-Control

CVE-2007-1863 · published 19 years ago
Summary

The Apache web server's caching feature can stop working if it receives a request that includes certain Cache-Control headers (s-maxage, max-age, min-fresh, or max-stale) without any value. This can cause the server process handling the request to crash, leading to a temporary loss of service. Disable caching or ensure that these headers always include a valid value to prevent the issue.

What to do
  • Update debian apache2 to version 2.2.4-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian apache2 < 2.2.4-1
Fix: upgrade to 2.2.4-1
Debian:13 debian apache2 < 2.2.4-1
Fix: upgrade to 2.2.4-1
Debian:14 debian apache2 < 2.2.4-1
Fix: upgrade to 2.2.4-1
– apple mac_os_x_server 10.0
10.1
10.1.1
10.1.2
10.1.3
10.1.4
10.1.5
10.2
10.2.1
10.2.2
10.2.3
10.2.4
24 more version ranges
cpe:2.3:o:apple:mac_os_x_server:10.0:*:*:*:*:*:*:*
– apache http_server >= 2.0.37, < 2.0.61
>= 2.2.0, < 2.2.6
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
Original advisory text
cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of servic...
cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.
References
Severity
5.0 Medium
Exploitation
12% chance of attack within 30 days
Timeline
Published27 Jun 2007
Updated19 Oct 2026
First seen28 Sep 2026
Sources
DEBIAN-CVE-2007-1863 · OSV
CVE-2007-1863 · NVD
Track software like this
Free during beta