Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2009-1955

HighPublic exploit

The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document…

Published Jun 8, 2009 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2009-1955

Key Facts

Patch immediately
  • CVE-2009-1955 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Apr-Util (Apache), HTTP Server (Apache), Mac OS X (Apple) and 22 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
  • EPSS estimates a 53% probability of exploitation in the next 30 days.
  • Fixed versions are available, including ant 0:1.6.5-1jpp_1rh, Apr-Util 1.3.7, Apr-Util 0:0.9.4-22.el4_8.1.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (30-day exploit likelihood)

53%

Higher than 98.9% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2009-1955 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.

Affected Products

59 affected entries in total
ProductAffected versionsFixed in
Apr-UtilApacheSee advisory1.3.7
HTTP ServerApacheSee advisory2.2.12
Mac OS XAppleSee advisory10.6.2
Ubuntu LinuxCanonical6.06, 8.04, 8.10, 9.04n/a
Debian LinuxDebian4.0n/a
20 more affected products in the full CVE brief

Patched Releases

ant

0:1.6.5-1jpp_1rh

Apr-Util

1.3.7, 0:0.9.4-22.el4_8.1, 0:1.2.7-7.el5_3.1, 1.2.12+dfsg-8+lenny2, 1.2.7-7.el5_3.1, 1.2.7+dfsg-2+etch2, 1.3.7+dfsg-1

HTTP Server

2.2.12

apache2

2.4.23-4.1

apache2-devel

2.4.23-4.1

apache2-doc

2.4.23-4.1

apache2-event

2.4.23-4.1

apache2-example-pages

2.4.23-4.1

apache2-prefork

2.4.23-4.1

apache2-utils

2.4.23-4.1

apache2-worker

2.4.23-4.1

Mac OS X

10.6.2

apr-util-devel

1.2.7-7.el5_3.1

apr-util-docs

1.2.7-7.el5_3.1

avalon-logkit

0:1.2-2jpp_4rh

axis

0:1.2.1-1jpp_3rh

classpathx-jaf

0:1.0-2jpp_6rh

classpathx-mail

0:1.1.1-2jpp_8rh

geronimo-specs

0:1.0-0.M4.1jpp_10rh

httpd

0:2.0.46-73.ent

httpd22

0:2.2.10-23.1.ep5.el4

jakarta-commons-modeler

0:2.0-3jpp_2rh

log4j

0:1.2.12-1jpp_1rh

mx4j

1:3.0.1-1jpp_4rh

pcsc-lite

0:1.3.3-3.el4

Timeline

  1. Publicly disclosed

    Jun 8, 2009

  2. Last updated

    Aug 4, 2026

Weakness Type

  • CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2009-1955 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo