Apache – CVE-2009-1955


Kayran has detected that the version of Apache APR-util being used has a flaw that could lead to a denial of service (DoS) attack.
The issue exists in the expat XML parser in the apr_xml_* interface in xml/apr_xml.c, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server. The issue presented in CVE-2009-1955 is similar to CVE-2003-1564.

A remote attacker could create a specially-crafted XML document that would cause excessive memory consumption (hence the denial of service) when processed by the XML decoding engine.
Demonstrated by a PROPFIND request.

This will cause a decrease in performance and also for interruptions in the availability of resources.


CVSS Version 2.0 – 5.0 Medium


To fix CVE-2009-1955, upgrade the version of Apache Server being used to 2.2.12.



< Return to all Vulnerabilities

Passwords 101

Unlike basketballs, “passwords” are things we don’t want to be passed around, especially in a society built around the idea that “mystery” is appealing. We

Read More »