CVE-2021-41524 vulnerability in Apache and Other Products
Published on October 5, 2021

null pointer dereference in h2 fuzzing

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Timeline

2021-09-17

reported by Gerald Lee

2021-09-26

fixed by r1893655 in 2.4.x 9 days later.

Weakness Type

NULL Pointer Dereference

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. NULL pointer dereference issues can occur through a number of flaws, including race conditions, and simple programming omissions.

Products Associated with CVE-2021-41524

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-41524 are published in these products:

Apache HTTP Server

Fedora Project Fedora

Oracle Instantis Enterprisetrack

NetApp Cloud Backup

Affected Versions

Apache Software Foundation Apache HTTP Server Version 2.4.49 is affected by CVE-2021-41524

Exploit Probability

EPSS

7.10%

Percentile

91.36%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.