CVE-2021-31618

NULL pointer dereference on specially crafted HTTP/2 request

Description

Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.

Key data

EPSS

Exploit Prediction Scoring System by FIRST: an estimate of the probability that exploitation activity will be observed in the next 30 days.

Score: 0.52142 (52.1% probability)
Percentile: 99.0%
Scores of: Nov 10, 2026
Model: v2026.06.15

CISA assessment as of May 20, 2024

Stakeholder-Specific Vulnerability Categorization (SSVC) decision points added by CISA.

Automatable: yes
Technical impact: partial

Weakness (CWE)

CWE catalog version 5.0.

CWE-476NULL Pointer Dereference

Affected products

Products listed in the CVE record, as the CNA published them.

Apache HTTP Server
- affected: 2.4.47

References

Links listed in the CVE record. They lead to other sites, which CubePath does not control.

httpd.apache.org/security/vulnerabilities_24.html
[oss-security] 20210609 CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 request (openwall.com)mailing-list
seclists.org/oss-sec/2021/q2/206
[httpd-cvs] 20210615 svn commit: r1890801 - /httpd/site/trunk/content/security/json/CVE-2021-31618.json (lists.apache.org)mailing-list
[httpd-cvs] 20210615 svn commit: r1075782 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_24.html (lists.apache.org)mailing-list
FEDORA-2021-051639aad4 (lists.fedoraproject.org)vendor-advisory
FEDORA-2021-181f29c392 (lists.fedoraproject.org)vendor-advisory
[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update (lists.debian.org)mailing-list
DSA-4937 (debian.org)vendor-advisory
GLSA-202107-38 (security.gentoo.org)vendor-advisory
oracle.com/security-alerts/cpuoct2021.html
security.netapp.com/advisory/ntap-20210727-0008
[oss-security] 20240313 Re: CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 request (openwall.com)mailing-list

Timeline

ID reservedApr 23, 2021
Record publishedJun 15, 2021
Record last updatedAug 3, 2024

Look up another CVE

About CubePath

CubePath is a cloud provider with data centers in Europe and the United States. It offers VPS, bare metal servers and DDoS protection.

Cloud VPS DDoS protection

Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Data as of Nov 10, 2026, 19:53 UTC. Sources and licenses