Servers and applications
CVE-2009-2699
The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.
- Severity
- High 7.5
- Published
- 13 Oct 2009
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 17 Oct 2026
- Fixed in
- 2.2.14
- Exploit chance
- 14% in the next 30 daysHigher than 96% of CVEs. EPSS by FIRST, 12 Nov 2026
- Weakness
- CWE-667
- Attack
- Over the network · No login needed · No user action needed
- Attacker can
- Take it down
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Apache HTTP ServerServers and applications · cpe:a:apache:http_server |
|