CVE-2007-3303 json
Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences exec…
published 2007-06-20 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-3293
- cvss
- 4.9
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large number of worker processes. NOTE: This might be an inherent design limitation of Apache with respect to worker processes in hosted environments.
Exploit prediction
0.89% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.9 | AV:L/AC:L/Au:N/C:N/I:N/A:C |
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
- Technology feeds
References
- security.psnc.pl /files/apache_report.pdf
-
osvdb.org
/37050
vdb-entry
-
securityfocus.com
/archive/1/469899/100/0/threaded
mailing-list
-
securityreason.com
/securityalert/2814
third-party-advisory
-
securityfocus.com
/archive/1/471832/100/0/threaded
mailing-list
-
securityfocus.com
/bid/24215
vdb-entry
Sources
- CVE List CVE-2007-3303
- NVD CVE-2007-3303
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.