CVE-2020-12845

Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences. A remote unauthenticated attacker can crash the server by sending an HTTP request to protected resources using a malformed Authorization header that is mishandled during a cherokee_buffer_add call within cherokee_validator_parse_basic or cherokee_validator_parse_digest.

• CWE-476

• http://cherokee-project.com/downloads.htmlVendor Advisory
• https://github.com/cherokee/webserver/issues/1242Exploit, Issue Tracking, Third Party Advisory
• https://github.com/cherokee/webserver/releasesThird Party Advisory
• https://security.gentoo.org/glsa/202012-09Third Party Advisory
• http://cherokee-project.com/downloads.htmlVendor Advisory
• https://github.com/cherokee/webserver/issues/1242Exploit, Issue Tracking, Third Party Advisory
• https://github.com/cherokee/webserver/releasesThird Party Advisory
• https://security.gentoo.org/glsa/202012-09Third Party Advisory

Published

Jul 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12839ismartgate PRO 1.5.9 is vulnerable to privilege escalation b…9.8
• CVE-2020-1284A denial of service vulnerability exists in the way that the…6.5
• CVE-2020-12840ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remot…6.5
• CVE-2020-12841ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remot…6.5
• CVE-2020-12842ismartgate PRO 1.5.9 is vulnerable to privilege escalation b…9.8
• CVE-2020-12843ismartgate PRO 1.5.9 is vulnerable to malicious file uploads…9.8
• CVE-2020-12846Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 a…8
• CVE-2020-12847Pydio Cells 2.0.4 web application offers an administrative c…7.2
• CVE-2020-12848In Pydio Cells 2.0.4, once an authenticated user shares a fi…5.4
• CVE-2020-12849Pydio Cells 2.0.4 allows any user to upload a profile image …5.4
• CVE-2020-1285<p>A remote code execution vulnerability exists in the way t…8.4
• CVE-2020-12850The following vulnerability applies only to the Pydio Cells …7