Apache HTTP Server 1.3.1 MIME Header Sioux denial of service

Summaryinfo

A vulnerability categorized as problematic has been discovered in Apache HTTP Server 1.3.1. This vulnerability affects unknown code of the component MIME Header Handler. Such manipulation leads to denial of service (Sioux). This vulnerability is traded as CVE-1999-1199. The attack may be launched remotely. Furthermore, there is an exploit available. This vulnerability is historically impactful due to its background and the reception it garnered. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Apache HTTP Server 1.3.1 (Web Server). Affected by this issue is an unknown functionality of the component MIME Header Handler. The manipulation with an unknown input leads to a denial of service vulnerability (Sioux). Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Apache WWW server 1.3.1 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via a large number of MIME headers with the same name, aka the "sioux" vulnerability.

The weakness was shared 08/07/1998 as confirmed posting (Bugtraq). The advisory is shared for download at marc.theaimsgroup.com. This vulnerability is handled as CVE-1999-1199. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a public exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/20/2025). The MITRE ATT&CK project declares the attack technique as T1499. This vulnerability has a historic impact due to its background and reception.

It is declared as highly functional. As 0-day the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 86816 (Apache 1.3 HTTP Server Multiple Header Denial of Service Vulnerability).

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (8326) and Vulnerability Center (SBV-3292†). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Web Server

Vendor

• Apache

Name

• HTTP Server

Version

• 1.3.1

License

• open-source

Support

• end of life (old version)

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion