CVE-2007-0086

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal

Metrics

CVSS 2.0 7.8/10AV:N/AC:L/Au:N/C:N/I:N/A:C

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Jan 5, 2007
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2007

CVE-2007-00877.8Microsoft Internet Information Services (IIS), when accessed through a TCP connection with a large window size, allows remote attackers to cCVE-2007-00885.0Multiple directory traversal vulnerabilities in openmedia allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) src pCVE-2007-00897.5jgbbs stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a databaseCVE-2007-00907.5WineGlass stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a dataCVE-2007-00917.5newsCMSlite stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a daCVE-2007-00927.5SQL injection vulnerability in productdetail.asp in E-SMARTCART 1.0 allows remote attackers to execute arbitrary SQL commands via the producCVE-2007-00937.5SQL injection vulnerability in page.php in Simple Web Content Management System allows remote attackers to execute arbitrary SQL commands viCVE-2007-00947.5Sven Moderow GuestBook 0.3a stores sensitive information under the web root with insufficient access control, which allows remote attackers CVE-2007-00955.0phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a direct request for themes/darkblue_orange/layout.inc.php, wCVE-2007-00967.5CarbonCommunities stores sensitive information under the web root with insufficient access control, which allows remote attackers to downloaCVE-2007-00979.3Multiple stack-based buffer overflows in the (1) LoadTree and (2) ReadHeader functions in PAISO.DLL 1.7.3.0 (1.7.3 beta) in ConeXware PowerACVE-2007-00986.8Directory traversal vulnerability in language.php in VerliAdmin 0.3 and earlier, when magic_quotes_gpc is disabled, allows remote attackers
CVE-2007-0086: High severity, CVSS 7.8 | Vulnix