VYPR
High severity7.5NVD Advisory· Published Jun 8, 2009· Updated Jun 16, 2026

CVE-2009-1955

CVE-2009-1955

Description

The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

16
  • Apache/Apr Util2 versions
    cpe:2.3:a:apache:apr-util:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:apr-util:*:*:*:*:*:*:*:*range: <1.3.7
    • (no CPE)range: < 1.3.7
  • cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*range: >=2.2.0,<2.2.12
    • (no CPE)
  • cpe:2.3:a:oracle:http_server:-:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
    Range: <10.6.2
  • cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*
  • cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

60

News mentions

0

No linked articles in our index yet.