cbcvebase.
CVE-2011-3192
published 2011-08-29

CVE-2011-3192: The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service…

PriorityP273high7.8CVSS 2.0
AVNACLAuNCNINAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
98.95%
99.9th percentile
The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

Affected

20 ranges
VendorProductVersion rangeFixed in
apachehttp_server>= 2.0.35 < 2.0.652.0.65
apachehttp_server>= 2.2.0 < 2.2.202.2.20
apachehttpd
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debianapache2< apache2 2.2.19-2 (bookworm)apache2 2.2.19-2 (bookworm)
opensuseopensuse
opensuseopensuse
suselinux_enterprise_server
suselinux_enterprise_server
suselinux_enterprise_software_development_kit
suselinux_enterprise_software_development_kit
tripodworksgigapod_2010_firmware<= 3.01.02
tripodworksgigapod_3_firmware<= 3.01.02
tripodworksgigapod_officehard_firmware<= 3.04.03
tripodworks_co_ltdgigapod_2010_gigapod_3_appliance_model
tripodworks_co_ltdgigapod_2010_gigapod_3_software_model
tripodworks_co_ltdgigapod_officehard_appliance_model

Detection & IOCsextracted from sources · hover to see the quote

otherRange:bytes=0-,0-
port8001/tcp
commandHEAD / HTTP/1.1\r\nHost: <target>\r\nRange:bytes=0-<overlapping ranges>\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n
  • Detect CVE-2011-3192 exploitation by inspecting HTTP requests for a Range header containing multiple overlapping byte ranges (e.g., 'Range: bytes=0-,0-' or a large number of overlapping ranges), which triggers memory and CPU exhaustion on vulnerable Apache versions 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19.
  • Monitor for nmap NSE script detection result 'http-vuln-cve2011-3192' flagging Apache byterange filter DoS vulnerability on scanned hosts, indicating active reconnaissance for CVE-2011-3192.
  • Alert on high-volume concurrent TCP connections to port 80 or 8001 from a single source sending HEAD requests with Range headers, consistent with the 'Apache Killer' DoS tool spawning 50 threads each sending 10 requests with overlapping byte ranges.
  • Check for the Metasploit auxiliary module 'auxiliary/dos/http/apache_range_dos' being used against Apache servers; this module implements the 'Apache Killer' technique targeting the byterange filter.
  • ·GIGAPOD file server appliances expose the vulnerable Apache instance specifically on port 8001/tcp (administrative interface), not only on the standard 80/443 ports; ensure detection coverage includes this non-standard port.
  • ·The vulnerability affects Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19; versions fixed in Debian are 2.2.19-2 and later.

CVSS provenance

nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
osv7.8HIGH
vulncheck7.8HIGH
vendor_apache7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.