CVE-2009-1890: The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before...

Security readout for executives and security teams

This issue affects Apache HTTP Server when used as a reverse proxy. A crafted request can make the proxy spend excessive CPU, reducing availability. The sources describe denial of service, not data theft or code execution. Public evidence in the bundle does not show active exploitation. Exposure is likely limited to Apache HTTP Server deployments using mod_proxy as a reverse proxy, especially mod_proxy_http paths. Systems not acting as reverse proxies are not indicated as affected by the supplied sources. Exact downstream package versions must be checked against vendor advisories. Prioritize remediation for internet-facing reverse proxies because availability can be affected remotely. This is not presented as code execution or data compromise, and active exploitation is not evidenced here, so urgency is operational rather than breach-driven. Mitigation focus: Identify Apache reverse proxy servers using mod_proxy_http.; Apply vendor patches from the relevant distribution advisory.; Upgrade away from Apache HTTP Server versions before 2.3.3 where applicable..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.