CVE-2021-31618

Description

Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.

How to fix CVE-2021-31618

To remediate CVE-2021-31618, upgrade the affected package to a fixed version below.

• —upgrade to 2.4.48-r0 or later
• —upgrade to 1.15.18 or later
• —upgrade to 2.4.46-5 or later

Is CVE-2021-31618 being exploited?

Moderate — EPSS is 15.0%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (3)

• from 0, < 2.4.48-r0
• >= 1.15.17, < 1.15.18, >= 2.4.47, < 2.4.48
• from 0, < 2.4.46-5

CVSS scores

References (16)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2021-31618
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-31618
• WEBhttpd.apache.org/security/vulnerabilities_24.html
• WEBlists.apache.org/thread.html/r14b66ef0f4f569fd515a3f96cd4eb58bd9a8ff525cc326bb0359664f%40%3Ccvs.httpd.apache.org%3E