What’s Vulnerable › Vulnerabilities

CVE-2005-2970

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2005-10-25 · updated 2026-06-16
• Weakness: CWE-770

Description

Memory leak in the worker MPM (worker.c) for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service (memory consumption) via aborted connections, which prevents the memory for the transaction pool from being reused for other connections.

Affected products

• Apache HTTP Server: from 2.0.36 before 2.0.55 — fixed in 2.0.55
• Canonical Ubuntu Linux: 4.10, 5.04, 5.10
• Fedoraproject Fedora Core: 4
• RedHat Enterprise Linux Desktop: 3.0, 4.0
• RedHat Enterprise Linux Server: 3.0, 4.0
• RedHat Enterprise Linux Workstation: 3.0, 4.0

How to fix

Upgrade to a fixed version: Apache HTTP Server 2.0.55. Check the vendor advisory for mitigations.

References

• http://mail-archives.apache.org/mod_mbox/httpd-cvs/200509.mbox/%3C20051001110218.40692.qmail%40minotaur.apache.org%3E
• http://rhn.redhat.com/errata/RHSA-2006-0159.html
• http://secunia.com/advisories/16559
• http://secunia.com/advisories/17923
• http://secunia.com/advisories/18161
• http://secunia.com/advisories/18333
• http://secunia.com/advisories/18585
• http://securitytracker.com/id?1015093
• http://svn.apache.org/viewcvs?rev=292949&view=rev
• http://www.mandriva.com/security/advisories?name=MDKSA-2005:233
• http://www.novell.com/linux/security/advisories/2005_28_sr.html
• http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00060.html

Get alerted when CVE-2005-2970 or the next vulnerability affects your stack