CVE-2014-3523

Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on…

5.0MediumCVSS base score
16.8%Exploitation in 30 daysEPSS · top 2.9% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted requests.

Timeline

2014
14 May 2014
14 May 2014
ID reserved
By redhat
20 Jul 20142 months later
20 Jul 2014· 2 months later
Published
2024
6 Aug 202410 years later
6 Aug 2024· 10 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2014-3523, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	2.0	Medium5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS (exploitation in 30 days): 16.8% · top 2.9% of all CVEs (9 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.

Affected products

n/a
- affected n/a

References

http://svn.apache.org/viewvc/httpd/httpd/trunk/server/mpm/winnt/child.c?r1=1608785&r2=1610652&diff_format=h (opens in a new tab)x_refsource_CONFIRMx_transferred
HPSBMU03409 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
http://httpd.apache.org/security/vulnerabilities_24.html (opens in a new tab)x_refsource_CONFIRMx_transferred
HPSBMU03380 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
http://svn.apache.org/viewvc/httpd/httpd/trunk/server/mpm/winnt/child.c (opens in a new tab)x_refsource_CONFIRMx_transferred
RHSA-2016:2957 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
68747 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073139 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1888194 [9/13] - /httpd/site/trunk/content/security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073149 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210603 svn commit: r1075360 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2014-3523](https://cveledger.app/badge/CVE-2014-3523.svg)](https://cveledger.app/cve/CVE-2014-3523)

Record last updated 6 Aug 2024, 10:50 UTC.