Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

so one of the mitigations for this advisory was:

1) Use SetEnvIf or mod_rewrite to detect a large number of ranges and then either ignore the Range: header or reject the request.

Option 1: (Apache 2.0 and 2.2)

      # Drop the Range header when more than 5 ranges.
      # CVE-2011-3192
      SetEnvIf Range (,.*?){5,} bad-range=1
      RequestHeader unset Range env=bad-range

      # optional logging.

      CustomLog logs/range-CVE-2011-3192.log common env=bad-range

Now when I add this to my httpd.conf:

<IfModule mod_setenvif.c>
SetEnvIf Range (,.*?){5,} bad-range=1
RequestHeader unset Range env=bad-range


I get this error when restarting Apache:

"Invalid command 'RequestHeader', perhaps misspelled or defined by a module not included in the server configuration"

The SetEvnIf module seems to be loaded.

What is wrong with that parameter?

Version is Apache/2.2.14 .

Link to the advisory is:

also, would Tomcat be vulnerable to this?


share|improve this question

RequestHeader requires you to load mod_headers

share|improve this answer

as per DerfK's answer, you need to load mod_headers -- a la

LoadModule headers_module modules/

in your conf file before the call to RequestHeader

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.