CVE-2011-0419HTTP Server Vulnerability
Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris…
Published May 16, 2011 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2011-0419, DSA-2237-2
Key Facts
Routine patching- CVE-2011-0419 is a medium-severity vulnerability (CVSS 4.3 v2) affecting HTTP Server (Apache), Portable Runtime (Apache), Mac OS X (Apple) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 30% probability of exploitation in the next 30 days.
- Fixed versions are available, including ant 0:1.7.1-13.jdk6.ep5.el4, ant 0:1.7.1-13.jdk6.ep5.el5, ant 0:1.7.1-14.ep5.el6.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Scores
CVSS v2
4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P
EPSS (30-day exploit likelihood)
30%
Higher than 98.2% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
35/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
2
Reports of active use
Advisories And Exploit References
Description
Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.
Affected Products
189 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| HTTP ServerApache | See advisory | 2.0.65 |
| Portable RuntimeApache | See advisory | 1.4.3 |
| Mac OS XApple | 10.6.0 | n/a |
| Debian LinuxDebian | 5.0, 6.0, 7.0 | n/a |
| FreebsdFreebsd | See advisory | n/a |
Patched Releases
ant
0:1.7.1-13.jdk6.ep5.el4, 0:1.7.1-13.jdk6.ep5.el5, 0:1.7.1-14.ep5.el6
antlr
0:2.7.7-7.ep5.el4, 0:2.7.7-7.ep5.el5, 0:2.7.7-7.ep5.el6
HTTP Server
2.0.65
Portable Runtime
1.4.3
apr
0:0.9.4-25.el4, 0:1.2.7-11.el5_6.4, 0:1.3.9-3.el6_0.1, 1.2.12-5+lenny4, 1.2.7-11.el5_6.4, 1.3.9-3.el6_0.1, 1.4.2-6+squeeze2, 1.4.4-1
apr-devel
1.2.7-11.el5_6.4, 1.3.9-3.el6_0.1, 1.7.0-3.1
apr-docs
1.2.7-11.el5_6.4
bcel
0:5.2-8.1.ep5.el4
cglib
0:2.2-5.1.1.1.jdk6.ep5.el5, 0:2.2-5.1.1.jdk6.ep5.el4, 0:2.2-5.4.ep5.el6
dom4j
0:1.6.1-11.1.ep5.el6, 0:1.6.1-11.ep5.el4, 0:1.6.1-11.ep5.el5
ecj
1:3.3.1.1-3.2.2.jdk6.ep5.el4
ecj3
1:3.3.1.1-3.1.1.1.jdk6.ep5.el5, 1:3.3.1.1-4.ep5.el6
glassfish-jaf
0:1.1.0-6.1.1.jdk6.ep5.el4
glassfish-javamail
0:1.4.2-0.4.ep5.el4
glassfish-jsf
0:1.2_13-2.2.1.jdk6.ep5.el4, 0:1.2_13-3.1.1.jdk6.ep5.el5, 0:1.2_13-3.1.4.ep5.el6
hibernate3
1:3.3.2-1.4.GA_CP04.ep5.el5, 1:3.3.2-1.5.GA_CP04.ep5.el4, 1:3.3.2-1.8.GA_CP04.ep5.el6
hibernate3-annotations
0:3.4.0-3.2.GA_CP04.ep5.el5, 0:3.4.0-3.3.GA_CP04.ep5.el4, 0:3.4.0-3.5.GA_CP04.ep5.el6
hibernate3-commons-annotations
0:3.1.0-1.8.ep5.el4, 0:3.1.0-1.8.ep5.el5, 0:3.1.0-1.8.ep5.el6
hibernate3-ejb-persistence
3.0-api-1:1.0.2-3.1.jdk6.ep5.el5, 3.0-api-1:1.0.2-3.3.ep5.el6, 3.0-api-1:1.0.2-3.jdk6.ep5.el4
hibernate3-entitymanager
0:3.4.0-4.3.GA_CP04.ep5.el4, 0:3.4.0-4.3.GA_CP04.ep5.el5, 0:3.4.0-4.4.GA_CP04.ep5.el6
httpd
0:2.2.17-11.1.ep5.el5, 0:2.2.17-11.2.ep5.el6
httpd22
0:2.2.17-14.ep5.el4
jakarta-commons-beanutils
0:1.8.0-4.1.1.jdk6.ep5.el4, 0:1.8.0-4.1.2.1.jdk6.ep5.el5, 0:1.8.0-9.ep5.el6
jakarta-commons-chain
0:1.2-2.2.1.ep5.el5, 0:1.2-2.2.2.ep5.el6, 0:1.2-2.2.ep5.el4
jakarta-commons-codec
0:1.3-12.1.ep5.el6, 0:1.3-9.1.1.jdk6.ep5.el4, 0:1.3-9.2.1.1.jdk6.ep5.el5
Timeline
Publicly disclosed
May 16, 2011
Last updated
Aug 4, 2026
Weakness Type
- CWE-770 Allocation of Resources Without Limits or Throttling
References
- advisorysecurity-tracker.debian.org · CVE-2011-0419
- advisorycvsweb.netbsd.org · fnmatch.c
- advisorycxib.net · apr_fnmatch.txts
- advisoryhttpd.apache.org · vulnerabilities_22.html
- advisorySUSE-SU-2011:1229
FAQ
Common Questions.
Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent…
Affected: HTTP Server (Apache); Portable Runtime (Apache); Mac OS X (Apple) versions 10.6.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including ant 0:1.7.1-13.jdk6.ep5.el4, ant 0:1.7.1-13.jdk6.ep5.el5, ant 0:1.7.1-14.ep5.el6.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2011-0419 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo