CVE-2009-1955: Apache APR-util expat XML parser nested entity denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 3.1 base score is 7.5 (HIGH) with a network, unauthenticated vector and high EPSS, though no KEV listing or known exploit is recorded.

What it is

The expat XML parser in the apr_xml_* interface in Apache APR-util before 1.3.7 mishandles XML documents containing a large number of nested entity references, causing excessive memory consumption. It affects APR-util as used by the mod_dav and mod_dav_svn modules in the Apache HTTP Server, so a single crafted request can exhaust server memory. The issue is a variant of the earlier CVE-2003-1564 entity expansion problem.

Impact

An attacker can drive uncontrolled memory consumption in the affected process, degrading or halting the HTTP service for legitimate users. There is no confidentiality or integrity impact; the effect is availability loss.

Attack surface

Reachable remotely over the network without authentication or user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The description shows it is delivered through a crafted XML body in a WebDAV request such as PROPFIND handled by mod_dav or mod_dav_svn.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented; EPSS is high at roughly 0.53 probability (99th percentile), and references include patch commits but no public exploit tag.

What to do

• Upgrade APR-util to 1.3.7 or later, or apply the vendor patch referenced in the Apache revision and apr-dev patch links.
• Apply the corresponding Apache HTTP Server, distribution, and OS vendor updates for mod_dav and mod_dav_svn.
• If patching is delayed, restrict or disable WebDAV methods such as PROPFIND where they are not required, or limit request body size at the reverse proxy.
• Monitor and cap memory usage for httpd worker processes to contain the impact of a single malicious request.

Detection

• Alert on PROPFIND or other WebDAV requests with unusually large or deeply nested XML bodies.
• Monitor httpd process memory growth correlated with XML request volume and flag abnormal spikes.
• Review web server logs for repeated PROPFIND requests from single sources or with oversized Content-Length values.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.