EUVD-2026-31894
GHSA-f24c-2c3h-f7jx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify exposed IBM HTTP Server
-
DeliveryConfirm mod_ibm_upload is loaded
-
ExploitSend crafted upload request
-
InstallTrigger null pointer dereference in module
-
C2Crash Apache worker process
-
ExecuteRepeat to exhaust workers
-
ImpactWeb tier denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target IBM HTTP Server (8.5 through Interim Fix 002, or 9.0) has the optional mod_ibm_upload module explicitly loaded - this module is not enabled by default, so deployments that do not use IBM's upload handling are not exposed. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N); the attacker needs only network reachability to the HTTP listener and the ability to send a crafted upload request to a URI processed by the module. Impact is limited to availability (C:N/I:N/A:H) - the bug crashes the server but does not yield code execution, data disclosure, or tampering - and SSVC rates technical impact as only 'partial', meaning the worker/process crashes rather than the entire host being compromised. |
| Impact | The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H) reflects a remote, low-complexity, unauthenticated availability-only impact - no confidentiality or integrity exposure. Real-world risk signals are mixed and lean lower than the headline score: EPSS is only 0.02% (4th percentile), there is no CISA KEV listing, SSVC records Exploitation as 'none' (no known active exploitation or public PoC), and Technical Impact is rated only 'partial'. The principal aggravating factor is that SSVC marks the issue as 'automatable: yes', meaning a single crafted request can reliably trigger the crash and could be scripted at scale. Crucially, exposure is gated by whether the optional mod_ibm_upload module is actually loaded - many IBM HTTP Server deployments do not enable it, which significantly narrows the realistic attack surface. Treat this as a moderate-priority availability patch for environments that use file upload features, not an emergency for the general IBM HTTP Server install base. |
| Exploit ScenarioDerived | An external attacker discovers an IBM HTTP Server instance (often via Server header or WebSphere fronting indicators) and sends a crafted HTTP upload request to a URL handled by mod_ibm_upload. The request triggers a null pointer dereference inside the module, causing the Apache worker to crash; repeated requests, easily scripted because SSVC notes the issue is automatable, exhaust workers and take the web tier offline, disrupting any WebSphere-backed applications it fronts. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Denial of service in IBM HTTP Server 8.5 and 9.0 allows remote unauthenticated attackers to crash the web server when the optional mod_ibm_upload module is loaded, triggering a null pointer dereference (CWE-476). No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.02% (4th percentile), though SSVC flags the issue as automatable with partial technical impact. Affected deployments include HTTP Server 8.5 up to Interim Fix 002 and HTTP Server 9.0, with a vendor patch available via IBM support note 7274065.
RemediationAI
Patch available per vendor advisory: apply the fix published in IBM support note https://www.ibm.com/support/pages/node/7274065, which supersedes Interim Fix 002 on the 8.5 branch and provides a fixed level for the 9.0 branch. If patching cannot occur immediately, the most direct compensating control is to unload mod_ibm_upload by removing or commenting out its LoadModule directive in httpd.conf and restarting the server - this fully eliminates the vulnerable code path, with the trade-off that any application relying on mod_ibm_upload for HTTP file upload handling will break and must be migrated to an alternative upload mechanism. As a secondary control, place a reverse proxy or WAF in front of IBM HTTP Server to block or rate-limit upload requests to endpoints that route through the module, accepting the cost of additional latency and a more complex request path. Confirm fix application by checking the installed iFix level against IBM's advisory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM HTTP Server is IBM's distribution of the Apache HTTP Server, bundled with WebSphere Application Server and used as a front-end web tier for J2EE applications. The vulnerable component is mod_ibm_upload, an optional IBM-specific Apache module that handles file upload processing - it is not loaded by default in stock Apache installs. The root cause is a CWE-476 null pointer dereference: a code path in the module dereferences a pointer that can be NULL when handling certain request inputs, causing the worker process to crash. Affected CPE is cpe:2.3:a:ibm:http_server:*:*:*:*:*:*:*:*, covering the 8.5.x line through Interim Fix 002 and the 9.0 branch.
Know when Http Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (ibm) · only source for this CVE.
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_ibm_upload.
Executive ViewAI
IBM HTTP Server versions 8.5 and 9.0 contain a remote denial-of-service vulnerability that can crash the web server when the optional mod_ibm_upload module is enabled, disrupting web services. The vulnerability affects any exposed HTTP Server instance with the optional component loaded. A vendor patch is available, and organizations should prioritize rapid deployment to mitigate service availability risk.
Apply vendor patch (IBM support note 7274065). If immediate patch deployment is infeasible, disable the optional mod_ibm_upload module to eliminate attack surface pending patch deployment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Http Server
View allA crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denia
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2
Oracle HTTP Server and WebLogic Server Proxy Plug-in have a CVSS 10.0 access control vulnerability allowing unauthentica
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directiv
mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from t
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which al
Exploit-DB