High severity7.5NVD Advisory· Published Apr 15, 2016· Updated May 6, 2026

CVE-2016-2146

Description

The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read, which allows remote attackers to cause a denial of service (worker process crash, web server deadlock, or memory consumption) via a large amount of POST data.

Affected products

Uninett/Mod Auth Mellon
cpe:2.3:a:uninett:mod_auth_mellon:*:*:*:*:*:*:*:*
Range: <=0.11.0
Fedoraproject/Fedora
cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/UNINETT/mod_auth_mellon/pull/71nvdPatch
lists.fedoraproject.org/pipermail/package-announce/2016-March/179085.htmlnvd
sympa.uninett.no/lists/uninett.no/arc/modmellon/2016-03/msg00000.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000