IBM HTTP Server versions 8.5 and 9.0 are vulnerable to denial of service when the optional mod_fastcgi module is enabled. The flaw allows an attacker to trigger a crash or resource exhaustion by requesting specially crafted content through the module, causing the server to become unavailable to legitimate users. The weakness is identified as CWE-617, indicating a logic flaw that permits resource overconsumption or server crash, leading to availability loss for the affected system.

The vulnerability affects IBM HTTP Server 8.5 and 9.0, including all associated patch levels that include the optional mod_fastcgi module. Users running these versions should examine whether the module is installed and active, as it is the attack surface for the denial of service condition.

The CVSS score of 6.2 indicates moderate severity. No EPSS score is available, so the publicly known exploit probability is uncertain, and the vulnerability is not listed in the CISA KEV catalog, implying no known exploited instances as of this analysis. The likely attack vector is remote via HTTP requests directed at the mod_fastcgi module. An attacker could potentially disrupt services without authentication, subjecting the impacted server to unplanned downtime.