Strix
26.1K

CVE-2021-31618

HIGHCVSS 7.5/10EPSS 51.21%

Last modified

CVE-2021-31618 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. EPSS estimates a 51.21% chance of exploitation in the next 30 days.

Description

Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
51.21%

98.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
ApacheHttp Server1.15.17
ApacheHttp Server2.4.47
FedoraprojectFedora33
FedoraprojectFedora34
DebianDebian Linux9.0
DebianDebian Linux10.0
OracleEnterprise Manager Ops Center12.4.0.0
OracleInstantis Enterprisetrack17.1
OracleInstantis Enterprisetrack17.2
OracleInstantis Enterprisetrack17.3
OracleZfs Storage Appliance Kit8.8

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-31618?
Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.
How severe is CVE-2021-31618?
CVE-2021-31618 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 51.21% probability of exploitation in the next 30 days.
How do I fix CVE-2021-31618?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-31618?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST