Vulnerabilities

TI-2021-11716 CVE-2021-31618 · GHSA-4jq3-qrx6-87cc

NULL pointer dereference on specially crafted HTTP/2 request

HIGH 71

Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.52142 Published 2021-06-15 No fix listed CWE-476

TI-2021-11032 CVE-2021-30641 · GHSA-jfgv-4796-2jw7

Unexpected URL matching with 'MergeSlashes OFF'

MEDIUM 56

Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.51765 Published 2021-06-10 Partial fix

TI-2021-08375 CVE-2021-26691 · GHSA-j3ww-p97m-gh9x

Apache HTTP Server mod_session response handling heap overflow

HIGH 79

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.68067 Published 2021-06-10 Partial fix CWE-122

TI-2021-08374 CVE-2021-26690 · GHSA-f669-j28w-pjvg

mod_session NULL pointer dereference

HIGH 69

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.65067 Published 2021-06-10 Partial fix CWE-476

TI-2020-17981 CVE-2020-35452 · GHSA-77mj-xh9q-fm9j

mod_auth_digest possible stack overflow by one nul byte

MEDIUM 64

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.53191 Published 2021-06-10 Partial fix CWE-787