IBM HTTP Server 8.5 and 9.0 can be forced into a denial‑of‑service state when the optional mod_mem_cache module is loaded. The flaw allows an attacker to exhaust system resources via crafted HTTP requests that engage the cache, leading to service unavailability. This weakness is classified as CWE‑825, an example of resource exhaustion that undermines availability.

The vulnerability affects IBM HTTP Server 8.5 and 9.0 products, from the initial release up through 8.5.5.29 and 9.0.5.28. All builds that include the mod_mem_cache module are susceptible unless the module is disabled or the system is updated to a level that contains the fix.

The CVSS score of 7.5 indicates a high severity DoS risk, yet the EPSS score is not available, suggesting a lower current exploitation probability. Attackers can trigger the DoS by sending specially crafted requests to a server that has mod_mem_cache enabled; however, no specific remote exploitation method is documented. The vulnerability is not listed in the CISA KEV catalog, so no publicly known active exploitation is currently reported.