CVE-2009-0751 Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with a large number of headers.
MediumCVSS 5.0
EPSS 10.4%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with a large number of headers.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yaws | <= 1.79 | No fix listed |
| yaws | = 1.50 | No fix listed |
| yaws | = 1.51 | No fix listed |
| yaws | = 1.52 | No fix listed |
| yaws | = 1.53 | No fix listed |
| yaws | = 1.54 | No fix listed |
| yaws | = 1.55 | No fix listed |
| yaws | = 1.56 | No fix listed |
| yaws | = 1.57 | No fix listed |
| yaws | = 1.58 | No fix listed |
| yaws | = 1.61 | No fix listed |
| yaws | = 1.62 | No fix listed |
| yaws | = 1.63 | No fix listed |
| yaws | = 1.64 | No fix listed |
| yaws | = 1.65 | No fix listed |
| yaws | = 1.66 | No fix listed |
| yaws | = 1.67 | No fix listed |
| yaws | = 1.68 | No fix listed |
| yaws | = 1.70 | No fix listed |
| yaws | = 1.71 | No fix listed |
| yaws | = 1.72 | No fix listed |
| yaws | = 1.73 | No fix listed |
| yaws | = 1.74 | No fix listed |
| yaws | = 1.75 | No fix listed |
| yaws | = 1.76 | No fix listed |
Show 5 more
| Product | Affected versions | Fixed in |
|---|---|---|
| yaws | = 1.77 | No fix listed |
| yaws | = 1.78 | No fix listed |
| debian/yaws(Debian:12) | < 1.80-1 | 1.80-1 |
| debian/yaws(Debian:13) | < 1.80-1 | 1.80-1 |
| debian/yaws(Debian:14) | < 1.80-1 | 1.80-1 |
References
- Debian Security Tracker CVE-2009-0751 vendor-advisory
- 33979 third-party-advisory vendor-advisory
- 34239 third-party-advisory
- DSA-1740 vendor-advisory
- [oss-security] 20090219 CVE request for yaws mailing-list
- 33834 vdb-entry
- ADV-2009-0590 vdb-entry
- yaws.hyber.org vendor-advisory
- 8148 exploit