Vulnerability · Published Jun 15, 2021 · Assigned by apache
CVE-2021-31618NULL pointer dereference on specially crafted HTTP/2 request
High 7.5
In plain English
A high-severity null pointer dereference in Apache HTTP Server from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 52.1% (higher than 99% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | apache2 | 2.4.48-r0 | ALPINE-CVE-2021-31618 |
| Alpine:v3.21 | apache2 | 2.4.48-r0 | ALPINE-CVE-2021-31618 |
| Alpine:v3.22 | apache2 | 2.4.48-r0 | ALPINE-CVE-2021-31618 |
| Alpine:v3.23 | apache2 | 2.4.48-r0 | ALPINE-CVE-2021-31618 |
| Alpine:v3.24 | apache2 | 2.4.48-r0 | ALPINE-CVE-2021-31618 |
| Debian:12 | apache2 | 2.4.46-5 | DEBIAN-CVE-2021-31618 |
| Debian:13 | apache2 | 2.4.46-5 | DEBIAN-CVE-2021-31618 |
| Debian:14 | apache2 | 2.4.46-5 | DEBIAN-CVE-2021-31618 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache HTTP Server | 2.4.47 |
Weakness: CWE-476
References
- http://httpd.apache.org/security/vulnerabilities_24.html
- [oss-security] 20210609 CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 request mailing-list
- https://seclists.org/oss-sec/2021/q2/206
- [httpd-cvs] 20210615 svn commit: r1890801 - /httpd/site/trunk/content/security/json/CVE-2021-31618.json mailing-list
- [httpd-cvs] 20210615 svn commit: r1075782 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_24.html mailing-list
- FEDORA-2021-051639aad4 vendor-advisory
- FEDORA-2021-181f29c392 vendor-advisory
- [debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update mailing-list
- DSA-4937 vendor-advisory
- GLSA-202107-38 vendor-advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://security.netapp.com/advisory/ntap-20210727-0008/
- [oss-security] 20240313 Re: CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 request mailing-list