CVE-2011-3192

Severity: high (CVSS 7.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 98.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-08-29 · updated 2026-06-16
Weakness: CWE-400

Description

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

Affected products

Apache HTTP Server: from 2.0.35 before 2.0.65; from 2.2.0 before 2.2.20 — fixed in 2.0.65, 2.2.20
Canonical Ubuntu Linux: 8.04, 10.04, 10.10, 11.04
Opensuse: 11.3, 11.4
SUSE Linux Enterprise Server: 10-sp2, 10-sp3, 10-sp4, 11-sp1
SUSE Linux Enterprise Software Development Kit: 10-sp3, 10-sp4, 11-sp1

How to fix

Upgrade to a fixed version: Apache HTTP Server 2.0.65, 2.2.20. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2011-3192 or the next vulnerability affects your stack