CVE-2021-31618
NULL pointer dereference on specially crafted HTTP/2 request
- State
- Published
- Severity
- Not scored
- Published
- Jun 15, 2021
- Updated
- Aug 3, 2024
- Reserved
- Apr 23, 2021
Description
Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.
Scores
The record has no CVSS score.
Weaknesses
- CWE-476 NULL Pointer Dereference
Affected Products
| Product | Versions |
|---|---|
Apache HTTP ServerApache Software Foundation |
|
References
- http://httpd.apache.org/security/vulnerabilities_24.html
- [oss-security] 20210609 CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 requestmailing-list
- https://seclists.org/oss-sec/2021/q2/206
- [httpd-cvs] 20210615 svn commit: r1890801 - /httpd/site/trunk/content/security/json/CVE-2021-31618.jsonmailing-list
- [httpd-cvs] 20210615 svn commit: r1075782 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_24.htmlmailing-list
- FEDORA-2021-051639aad4vendor-advisory
- FEDORA-2021-181f29c392vendor-advisory
- [debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security updatemailing-list
- DSA-4937vendor-advisory
- GLSA-202107-38vendor-advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://security.netapp.com/advisory/ntap-20210727-0008/
- [oss-security] 20240313 Re: CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 requestmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.