CVE-2026-48834 - Vulnerability Details - OpenCVE

Description

Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.1.

Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing.
Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Published: 2026-08-05

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

Apache Answer versions up to 2.0.1 exhibit an improper handling of a length parameter inconsistency in the parsing of the Accept-Language header. An attacker who can send a crafted header can cause the server to consume excessive CPU resources while parsing, degrading service availability.

Affected Systems

The vulnerability affects Apache Answer through version 2.0.1. The affected vendor is Apache Software Foundation and the product is Apache Answer. Version 2.0.2 and later contain a fix.

Risk and Exploitability

The vulnerability can be triggered by unauthenticated attackers. While no EPSS score is available and the issue is not listed in the CISA KEV catalog, the potential for high CPU consumption indicates a real risk of resource exhaustion. The lack of a published CVSS score makes precise severity grading difficult, but the denial‑of‑service impact coupled with easy remote trigger suggests an urgent remedial action.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache Answer

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.0.1

No data.

No data.

Vendor Product Confidence Versions

Apache

Answer

95%

Version	Status	Scheme	Platform
`[0,2.0.1]`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the vendor’s patch by upgrading to Apache Answer 2.0.2 or later.
Reduce the maximum Accept‑Language header length or strip the header before parsing to limit resource use.
Monitor server CPU utilization for spikes and investigate any unexpected high usage to detect potential exploitation attempts.

Generated by OpenCVE AI on August 5, 2026 at 16:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://lists.apache.org/thread/0yg5smwnbrhqs55m5h61gn42mcs8s95p

History

Wed, 05 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apache Apache answer
Vendors & Products		Apache Apache answer

Wed, 05 Aug 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Title		Apache Answer: Denial of service via crafted Accept-Language header parsing
Weaknesses		CWE-400
References		https://lists.apache.org/thread/0yg5smwnbrhqs55m5h61gn42mcs8s95p

Subscriptions

Apache Answer

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2026-08-05T15:07:35.440Z

Updated: 2026-08-05T16:32:54.160Z

Reserved: 2026-05-25T11:13:04.242Z

Link: CVE-2026-48834

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-05T16:30:13Z

Weaknesses

CWE-400
Uncontrolled Resource Consumption

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48834", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-05-25T11:13:04.242Z", "datePublished": "2026-08-05T15:07:35.440Z", "dateUpdated": "2026-08-05T16:32:54.160Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache Answer", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.0.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "tonghuaroot"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.1.</p>Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing.<br><p>Users are recommended to upgrade to version 2.0.2, which fixes the issue.</p>"}], "value": "Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 2.0.1.\n\nUnauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing.\nUsers are recommended to upgrade to version 2.0.2, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-05T15:07:35.440Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/0yg5smwnbrhqs55m5h61gn42mcs8s95p"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache Answer: Denial of service via crafted Accept-Language header parsing", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/05/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-05T16:32:54.160Z"}}]}}