EUVD-2026-31896
GHSA-5grx-55jc-2fff
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, low-complexity, unauthenticated DoS with availability-only impact; mod_fastcgi being optional is a config precondition, not an access barrier, so PR stays N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_fastcgi module.
AnalysisAI
Denial of service in IBM HTTP Server 8.5 and 9.0 allows remote attackers to crash the server by triggering a reachable assertion in the optional mod_fastcgi module. The flaw affects availability only (no data exposure or code execution) and, per the CVSS PR:N vector, requires no authentication, but exploitation depends on the non-default mod_fastcgi module being enabled. There is no public exploit identified at time of analysis, EPSS is very low (0.03%, 9th percentile), and it is not listed in CISA KEV.
Technical ContextAI
IBM HTTP Server is IBM's Apache-derived web server, commonly bundled with WebSphere Application Server as its front-end HTTP tier. The vulnerable component is mod_fastcgi, an optional module that proxies requests to FastCGI application processes. The root cause is CWE-617 (Reachable Assertion): attacker-influenced input reaches an assertion or equivalent abort condition in the FastCGI handling path, causing the worker or process to terminate abnormally rather than handling the error gracefully. Because the impact is a controlled abort rather than memory corruption, confidentiality and integrity are unaffected (C:N/I:N) while availability is fully impacted (A:H).
RemediationAI
Patch available per vendor advisory: apply the fix from IBM's security bulletin at https://www.ibm.com/support/pages/node/7274065 (for 8.5, install the interim fix that supersedes Interim Fix 002; for 9.0, apply the corresponding fixpack or interim fix - confirm exact levels in the bulletin, as no specific fix version is provided in the source data). As an immediate compensating control where patching must be deferred, disable or unload the optional mod_fastcgi module in the httpd configuration if FastCGI is not required, which fully removes the vulnerable code path but breaks any applications relying on FastCGI proxying. If mod_fastcgi must remain enabled, restrict network access to the affected virtual hosts and ports and place the server behind a reverse proxy or WAF that can rate-limit and filter malformed FastCGI-triggering requests, accepting the added latency and operational overhead.
More in Http Server
View allA crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denia
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2
Oracle HTTP Server and WebLogic Server Proxy Plug-in have a CVSS 10.0 access control vulnerability allowing unauthentica
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directiv
mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from t
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which al
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party mod
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today