EUVD-2026-53396
GHSA-9mxc-x85j-v2wc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-accessible via standard HTTP header with no auth, low complexity, no confidentiality or integrity impact - only high availability impact from CPU exhaustion.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
AnalysisAI
Denial of service in Apache Answer through 2.0.1 allows unauthenticated remote attackers to exhaust CPU resources by sending a specially crafted Accept-Language HTTP header that triggers runaway parsing logic. The root cause is improper handling of a length parameter inconsistency (CWE-400) during header processing, meaning any unauthenticated HTTP request reaching the application can be weaponized for resource exhaustion. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond network access to an HTTP endpoint served by Apache Answer through version 2.0.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No official CVSS score was provided by NVD or the vendor for this CVE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Apache Answer to version 2.0.2, which the Apache Software Foundation has confirmed resolves this issue. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Answer
View allUnauthenticated information disclosure in Apache Answer through 2.0.1 allows any remote user to retrieve deleted or pend
Account takeover in Apache Answer through 2.0.1 allows unauthenticated remote attackers to seize arbitrary user accounts
Privilege persistence in Apache Answer through version 2.0.0 allows suspended, deleted, or deactivated administrator acc
Insecure Direct Object Reference (IDOR) in Apache Answer through version 2.0.1 allows any authenticated user to delete u
Improper authorization in Apache Answer through version 2.0.1 allows any authenticated user to reject arbitrary pending
Privileged API access in Apache Answer through 2.0.1 persists after an administrator loses their authority: keys issued
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today