Apache Answer EUVD-2026-53396

No special conditions are required beyond network access to an HTTP endpoint served by Apache Answer through version 2.0.1. The vulnerability is triggered by the Accept-Language header, which is a standard HTTP header processed on every request regardless of authentication state, meaning any unauthenticated HTTP client - including anonymous users and automated scanners - can trigger it. No specific feature flag, non-default configuration, or privileged account is needed. Exploitation is limited only by network reachability: instances that are firewalled or restricted to internal networks reduce the attacker pool but do not eliminate the risk from insiders or compromised internal systems. The attack does not require session state, cookies, or prior interaction with the application.

No official CVSS score was provided by NVD or the vendor for this CVE. Based on independent assessment (see assessed_cvss_vector), this vulnerability scores approximately 7.5 (High) on CVSS 3.1, driven by network reachability, no required authentication, and high availability impact. The absence of EPSS data and KEV listing means real-world exploitation probability cannot be quantified from available signals. However, the attack profile is straightforward: any unauthenticated HTTP client can trigger the condition with a single crafted request, making this potentially automatable and attractive for volumetric or targeted DoS campaigns. There is no confidentiality or integrity impact - the blast radius is limited to availability. The primary business risk is service disruption for community platforms relying on Apache Answer. Organizations running publicly exposed instances should treat this as a high operational priority despite the lack of confirmed exploitation, given the trivial attack prerequisites. The conflict to flag: the vendor has not published a formal CVSS vector, so severity metrics here are analyst-inferred rather than vendor-confirmed.

An unauthenticated attacker sends a single HTTP GET or POST request to any public-facing endpoint of an Apache Answer instance, with the Accept-Language header populated with a specially crafted value that triggers the length parameter inconsistency in the parser. The server's CPU spikes to near-100% processing the malformed header, causing legitimate requests to queue and eventually time out, effectively taking the Q&A platform offline. No public exploit code has been identified, but the attack requires no credentials or prior knowledge of the target application state.