Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Apache 2.2.12‑2.2.21 can stop handling traffic

CVE-2012-4557 · published 13 years ago
Summary

Web servers running Apache version 2.2.12 through 2.2.21 may mark a processing unit as failed when a request takes too long. An attacker can exploit this to make the server stop responding to legitimate users. Upgrade Apache to a newer release or apply the available patch to prevent the issue.

What to do
  • Update debian apache2 to version 2.2.22-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian apache2 < 2.2.22-1
Fix: upgrade to 2.2.22-1
Debian:13 debian apache2 < 2.2.22-1
Fix: upgrade to 2.2.22-1
Debian:14 debian apache2 < 2.2.22-1
Fix: upgrade to 2.2.22-1
– apache http_server 2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.20
2.2.21
cpe:2.3:a:apache:http_server:2.2.12:*:*:*:*:*:*:*
Original advisory text
The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to ...
The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.
References
Severity
5.0 Medium
Exploitation
17% chance of attack within 30 days
Type
CWE-399Resource Management Errors
Timeline
Published30 Nov 2012
Updated29 Sep 2026
First seen3 Sep 2026
Sources
DEBIAN-CVE-2012-4557 · OSV
CVE-2012-4557 · NVD
Track software like this
Free during beta