Read the docs
TI-2020-17981 Aliases CVE-2020-35452GHSA-77mj-xh9q-fm9j

mod_auth_digest possible stack overflow by one nul byte

Priority MEDIUM 64CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Partial Red Hat: 4 fixed, 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow

Why it matters now

EPSS 0.53191 98th percentileScored 2026-11-07
Fix Partial Red Hat: 3 advisoriesRed Hat: 4 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache HTTP Server2.4.46; 2.4.43; 2.4.41; 2.4.39; 2.4.38; 2.4.37; 2.4.35; 2.4.34; 2.4.33; 2.4.29; 2.4.28; 2.4.27; 2.4.26; 2.4.25; 2.4.23; 2.4.20; 2.4.18; 2.4.17; 2.4.16; 2.4.12; 2.4.10; 2.4.9; 2.4.7; 2.4.6; 2.4.4; 2.4.3; 2.4.2; 2.4.1; 2.4.0—No fix listedCNA
  • Apache HTTP Server VendorApache Affected 2.4.46; 2.4.43; 2.4.41; 2.4.39; 2.4.38; 2.4.37; 2.4.35; 2.4.34; 2.4.33; 2.4.29; 2.4.28; 2.4.27; 2.4.26; 2.4.25; 2.4.23; 2.4.20; 2.4.18; 2.4.17; 2.4.16; 2.4.12; 2.4.10; 2.4.9; 2.4.7; 2.4.6; 2.4.4; 2.4.3; 2.4.2; 2.4.1; 2.4.0 Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*2.4.0 – 2.4.46VulnerableApache
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*12.4.0.0VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*17.1VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*17.2VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*17.3VulnerableOracle
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*8.8VulnerableOracle
  • cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions 2.4.0 – 2.4.46 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* Versions 12.4.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* Versions 17.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* Versions 17.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* Versions 17.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Oracle

Remediation

Red Hat 3 advisories

  • RHSA-2022:1915 Released 2022-05-10 · Red Hat rating Moderate
    httpd:2.4 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) httpd-2.4.37-47.module+el8.6.0+14529+083145da.1.aarch64::httpd:2.4, httpd-2.4.37-47.module+el8.6.0+14529+083145da.1.ppc64le::httpd:2.4, httpd-2.4.37-47.module+el8.6.0+14529+083145da.1.s390x::httpd:2.4 +38
  • RHSA-2021:4614 Released 2021-11-10 · Red Hat rating Moderate
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP10 security update
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-1.6.3-107.jbcs.el7, jbcs-httpd24-apr-devel-1.6.3-107.jbcs.el7, jbcs-httpd24-apr-util-1.6.1-84.jbcs.el7 +36
    • Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-apr-1.6.3-107.el8jbcs, jbcs-httpd24-apr-devel-1.6.3-107.el8jbcs, jbcs-httpd24-apr-util-1.6.1-84.el8jbcs +36
  • RHSA-2021:4613 Released 2021-11-10 · Red Hat rating Moderate
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP10 security update
    • Red Hat JBoss Core Services

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache HTTP Server — GLSA-202107-38

    7 records Highest priority Priority HIGH 3 HIGH, 4 MEDIUM

    Other records, highest priority first

    • TI-2021-08375 Apache HTTP Server mod_session response handling heap overflowPriority HIGH 79
    • TI-2021-11716 NULL pointer dereference on specially crafted HTTP/2 requestPriority HIGH 71
    • TI-2021-08374 mod_session NULL pointer dereferencePriority HIGH 69
    Show all 7 records → Advisory →
  • Advisory ·

    Apache HTTP Server — DSA-4937

    5 records Highest priority Priority HIGH 3 HIGH, 2 MEDIUM

    Other records, highest priority first

    • TI-2021-08375 Apache HTTP Server mod_session response handling heap overflowPriority HIGH 79
    • TI-2021-11716 NULL pointer dereference on specially crafted HTTP/2 requestPriority HIGH 71
    • TI-2021-08374 mod_session NULL pointer dereferencePriority HIGH 69
    Show all 5 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Web Server 2AffectedNo fix planned: Out of support scope
Red Hat Software CollectionsAffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:1915
Red Hat JBoss Core ServicesFixed RHSA-2021:4613
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2021:4614
Red Hat JBoss Core Services on RHEL 8Fixed RHSA-2021:4614
Not affected: 1 product
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-35452
  2. 2026-10-03 Alias added: GHSA-77mj-xh9q-fm9j
  3. 2026-10-07 EPSS moved to the 99th percentile and above
  4. 2026-11-05 EPSS moved to the 95th–99th percentile
  5. 2026-11-06 Priority changed: HIGH → MEDIUM

References

Advisory 10

Other 2

  • TI-2021-18535 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-18417 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-25716 Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. KEVCVSS 3.1CRITICAL 9.1
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
  • TI-2019-00184 Use after free in Apache HTTP Server KEVCVSS 3.1HIGH 7.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
See all 349 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences