What’s Vulnerable › Vulnerabilities

CVE-2009-2699

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2009-10-13 · updated 2026-06-16
• Weakness: CWE-667

Description

The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.

Affected products

• Apache HTTP Server: from 2.2.0 before 2.2.14 — fixed in 2.2.14
• Apache Software Foundation Apache Portable Runtime (APR): before 1.3.9 — fixed in 1.3.9

How to fix

Upgrade to a fixed version: Apache HTTP Server 2.2.14; Apache Software Foundation Apache Portable Runtime (APR) 1.3.9. Check the vendor advisory for mitigations.

References

• http://marc.info/?l=bugtraq&m=133355494609819&w=2
• http://securitytracker.com/id?1022988
• http://www.apache.org/dist/httpd/CHANGES_2.2.14
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
• http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
• http://www.securityfocus.com/bid/36596
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53666
• https://issues.apache.org/bugzilla/show_bug.cgi?id=47645
• https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

Get alerted when CVE-2009-2699 or the next vulnerability affects your stack