What is the CVSS score of EUVD-2026-53396?

EUVD-2026-53396 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Apache Answer EUVD-2026-53396

| CVE-2026-48834 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-08-05 apache

GHSA-9mxc-x85j-v2wc

Apache Denial Of Service Apache Answer

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-accessible via standard HTTP header with no auth, low complexity, no confidentiality or integrity impact - only high availability impact from CPU exhaustion.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Aug 06, 2026 - 15:22 NVD

MEDIUM HIGH

CVSS changed

Aug 06, 2026 - 15:22 NVD

7.5 (MEDIUM) 7.5 (HIGH)

Analysis Generated

Aug 05, 2026 - 15:50 vuln.today

DescriptionCVE.org

Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.1.

Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

AnalysisAI

Denial of service in Apache Answer through 2.0.1 allows unauthenticated remote attackers to exhaust CPU resources by sending a specially crafted Accept-Language HTTP header that triggers runaway parsing logic. The root cause is improper handling of a length parameter inconsistency (CWE-400) during header processing, meaning any unauthenticated HTTP request reaching the application can be weaponized for resource exhaustion. No public exploit code or CISA KEV listing has been identified at time of analysis, and the Apache Software Foundation has released a remediated version 2.0.2.

Technical ContextAI

Apache Answer is an open-source Q&A community platform developed under the Apache Software Foundation (CPE: cpe:2.3:a:apache_software_foundation:apache_answer:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), a root-cause class where an application fails to properly constrain the amount of resources it consumes in response to attacker-controlled input. Specifically, the flaw resides in the HTTP Accept-Language header parser, which mishandles a length parameter inconsistency - a pattern where the stated or implied length of an input field diverges from its actual content in a way the parser does not safely resolve. This causes the CPU to spiral into excessive computation, likely due to a pathological parsing path (e.g., quadratic or exponential time complexity on certain malformed inputs). Because Accept-Language is a standard HTTP request header processed early in request handling, the vulnerability is reachable without authentication on any exposed endpoint.

RemediationAI

Upgrade Apache Answer to version 2.0.2, which the Apache Software Foundation has confirmed resolves this issue. The upgrade is the sole vendor-endorsed remediation, documented at https://lists.apache.org/thread/0yg5smwnbrhqs55m5h61gn42mcs8s95p. If an immediate upgrade is not feasible, consider deploying a Web Application Firewall or reverse proxy (e.g., nginx, Cloudflare) configured to validate and reject malformed or excessively complex Accept-Language header values before they reach the application - note this adds operational complexity and may not block all malformed variants. Rate-limiting HTTP requests at the network perimeter can reduce the impact of volumetric exploitation but will not prevent a single well-crafted request from consuming CPU. No other workarounds are identified in the available data. Patch availability is vendor-confirmed at version 2.0.2; no independent verification of fix completeness has been performed.