CVE-2021-41524 null pointer dereference in h2 fuzzing
An external attacker can cause a denial of service in Apache HTTP Server by sending a specially crafted HTTP/2 request that triggers a null pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41524?
CVE-2021-41524 is a high-severity vulnerability in Apache Http Server, published on 5 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.
Weakness: CWE-476
Which versions are affected by CVE-2021-41524?
1 open source package ship an affected version, including apache. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | From 2.4.49 | 2.4.50 |
Products include Apache Http Server, Fedoraproject Fedora, Netapp Cloud Backup, Oracle Instantis Enterprisetrack.
How do I fix CVE-2021-41524?
Upgrade apache to 2.4.50 or later.
Is CVE-2021-41524 being exploited?
There is no known exploitation of CVE-2021-41524 in the wild and no public exploit code.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2021-41524, BIT-apache-2021-41524, CLEANSTART-2026-EB87524, DEBIAN-CVE-2021-41524, GHSA-f29c-hjcq-ww2f.