The log_cookie function in mod_log_config.c in the...
Low severity
Unreviewed
Published
May 4, 2022
to the GitHub Advisory Database
•
Updated Apr 11, 2025
Description
Published by the National Vulnerability Database
Jan 28, 2012
Published to the GitHub Advisory Database
May 4, 2022
Last updated
Apr 11, 2025
The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.
References