CVE-2014-0118

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 37.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-07-20 · updated 2026-06-17
Weakness: CWE-400

Description

The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.

Affected products

Apache HTTP Server: from 2.2.0 before 2.2.29; from 2.4.1 before 2.4.10 — fixed in 2.2.29, 2.4.10
Debian Linux: 7.0, 8.0
Red Hat JBoss EAP: 6.0.0, 6.4.0

How to fix

Upgrade to a fixed version: Apache HTTP Server 2.2.29, 2.4.10. Check the vendor advisory for mitigations.

References

http://advisories.mageia.org/MGASA-2014-0304.html
http://advisories.mageia.org/MGASA-2014-0305.html
http://httpd.apache.org/security/vulnerabilities_24.html
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
http://marc.info/?l=bugtraq&m=143403519711434&w=2
http://marc.info/?l=bugtraq&m=143748090628601&w=2
http://marc.info/?l=bugtraq&m=144050155601375&w=2
http://marc.info/?l=bugtraq&m=144493176821532&w=2
http://rhn.redhat.com/errata/RHSA-2014-1019.html
http://rhn.redhat.com/errata/RHSA-2014-1020.html
http://rhn.redhat.com/errata/RHSA-2014-1021.html
http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES

Get alerted when CVE-2014-0118 or the next vulnerability affects your stack