Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.0
CVE-2012-0840: Apache Portable Runtime can be forced into high CPU use
CVE-2012-0840 · published 14 years ago
Summary
The Apache Portable Runtime library (versions up to 1.4.5) can be tricked into doing a huge amount of work when it processes specially crafted data. This can slow down or temporarily stop an application that uses the library, effectively causing a denial of service. Updating to a newer version of the library or applying the vendor’s patch removes the problem.
What to do
- Update debian apr to version 1.4.6-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | apr |
< 1.4.6-1 Fix: upgrade to 1.4.6-1
|
| Debian:13 | debian | apr |
< 1.4.6-1 Fix: upgrade to 1.4.6-1
|
| Debian:14 | debian | apr |
< 1.4.6-1 Fix: upgrade to 1.4.6-1
|
| – | apache | portable_runtime |
<= 1.4.5 0.9.1 0.9.2 0.9.2-dev 0.9.3 0.9.3-dev 0.9.4 0.9.5 0.9.6 0.9.7 0.9.7-dev 0.9.8 23 more version ranges
cpe:2.3:a:apache:portable_runtime:*:*:*:*:*:*:*:* |
Original advisory text
tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-depend...
tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
References
- https://security-tracker.debian.org/tracker/CVE-2012-0840 Vendor Advisory
- http://mail-archives.apache.org/mod_mbox/apr-commits/201201.mbox/%3C201201150037...
- http://openwall.com/lists/oss-security/2012/02/08/3
- http://openwall.com/lists/oss-security/2012/02/09/1
- http://secunia.com/advisories/47862 Vendor Advisory
- http://svn.apache.org/viewvc?rev=1231605&view=rev Patch
- http://www.mail-archive.com/dev%40apr.apache.org/msg24439.html
- http://www.mail-archive.com/dev%40apr.apache.org/msg24472.html
- http://www.mail-archive.com/dev%40apr.apache.org/msg24473.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:019
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73096
Severity
5.0
Medium
Type
CWE-20Improper Input Validation
Timeline
Published10 Feb 2012
Updated29 Sep 2026
First seen5 Sep 2026
Track software like this
Free during beta