CVE-2016-2146
HighSummary
The am_read_post_data function in mod_auth_mellon before version 0.11.1 does not limit the amount of data read, allowing remote attackers to cause a denial of service via a large amount of POST data.
Risk Assessment
Attackers can exploit this vulnerability to crash the worker process, leading to web server unavailability or excessive memory consumption.
Recommendation
It is recommended to update mod_auth_mellon to version 0.11.1 or later to mitigate this vulnerability.
Other vulnerabilities in mod_auth_mellon
See all- CVE-2016-2145High
The am_read_post_data function in mod_auth_mellon before version 0.11.1 does not check if the ap_get_client_block function returns an error, allowing remote attackers to cause a denial of service (segmentation fault and process crash) via crafted POST data.
- CVE-2014-8567High
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
Original NVD description (English source)
The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read, which allows remote attackers to cause a denial of service (worker process crash, web server deadlock, or memory consumption) via a large amount of POST data.