A flaw in IBM HTTP Server versions 8.5 and 9.0 allows a denial of service when an attacker can write to parts of the server configuration. The vulnerability is a resource exhaustion attack that nondestructively halts or slows service, degrading availability. The weakness corresponds to inadequate resource management (CWE-400).

IBM HTTP Server 8.5.x and 9.0.x are affected as noted by the CNA vendor and product listings. The short‑form CPEs indicate all minor releases within those major versions are vulnerable unless mitigated by a fix pack or interim patch.

The CVSS score of 7.7 reflects a high severity denial‑of‑service condition with medium complexity. No EPSS score is available, so current exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed active exploitation. Based on the description, the likely attack vector requires write access to the server configuration, suggesting the threat may arise from privileged users, compromised credentials, or local exploitation on a co‑located system.