--- title: "CVE-2021-31618: NULL pointer dereference on specially… | CubePath" description: "Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server…" language: en source: https://cubepath.com/security/cve/CVE-2021-31618 --- # CVE-2021-31618: NULL pointer dereference on specially… | CubePath ## Description Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod\_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released. Official description from the CVE record, published by apache. Copyright © 1999-2026 The MITRE Corporation. See [/security/cve/legal](https://cubepath.com/security/cve/legal) for the CVE license. [View the record on cve.org](https://www.cve.org/CVERecord?id=CVE-2021-31618) ## Key data ### EPSS Exploit Prediction Scoring System by FIRST: an estimate of the probability that exploitation activity will be observed in the next 30 days. Score 0.52142 (52.1% probability) Percentile 99.0% Scores of Nov 10, 2026 Model v2026.06.15 ### CISA assessment as of May 20, 2024 Stakeholder-Specific Vulnerability Categorization (SSVC) decision points added by CISA. Automatable yes Technical impact partial ### Weakness (CWE) CWE catalog version 5.0. CWE names: Copyright © 2006-2026, The MITRE Corporation. See [/security/cve/legal](https://cubepath.com/security/cve/legal) for the CWE license. - [CWE-476](https://cwe.mitre.org/data/definitions/476.html) NULL Pointer Dereference ## Affected products Products listed in the CVE record, as the CNA published them. - Apache HTTP Server - affected: 2.4.47 ## References Links listed in the CVE record. They lead to other sites, which CubePath does not control. - [httpd.apache.org/security/vulnerabilities\_24.html](http://httpd.apache.org/security/vulnerabilities%5F24.html) - [\[oss-security\] 20210609 CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 request](http://www.openwall.com/lists/oss-security/2021/06/10/9) (openwall.com) mailing-list - [seclists.org/oss-sec/2021/q2/206](https://seclists.org/oss-sec/2021/q2/206) - [\[httpd-cvs\] 20210615 svn commit: r1890801 - /httpd/site/trunk/content/security/json/CVE-2021-31618.json](https://lists.apache.org/thread.html/r14b66ef0f4f569fd515a3f96cd4eb58bd9a8ff525cc326bb0359664f%40%3Ccvs.httpd.apache.org%3E) (lists.apache.org) mailing-list - [\[httpd-cvs\] 20210615 svn commit: r1075782 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities\_24.html](https://lists.apache.org/thread.html/r783b6558abf3305b17ea462bed4bd66d82866438999bf38cef6d11d1%40%3Ccvs.httpd.apache.org%3E) (lists.apache.org) mailing-list - [FEDORA-2021-051639aad4](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NKJ3ZA3FTSZ2QBBPKS6BYGAWYRABNQQ/) (lists.fedoraproject.org) vendor-advisory - [FEDORA-2021-181f29c392](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A73QJ4HPUMU26I6EULG6SCK67TUEXZYR/) (lists.fedoraproject.org) vendor-advisory - [\[debian-lts-announce\] 20210709 \[SECURITY\] \[DLA 2706-1\] apache2 security update](https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html) (lists.debian.org) mailing-list - [DSA-4937](https://www.debian.org/security/2021/dsa-4937) (debian.org) vendor-advisory - [GLSA-202107-38](https://security.gentoo.org/glsa/202107-38) (security.gentoo.org) vendor-advisory - [oracle.com/security-alerts/cpuoct2021.html](https://www.oracle.com/security-alerts/cpuoct2021.html) - [security.netapp.com/advisory/ntap-20210727-0008](https://security.netapp.com/advisory/ntap-20210727-0008/) - [\[oss-security\] 20240313 Re: CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 request](http://www.openwall.com/lists/oss-security/2024/03/13/2) (openwall.com) mailing-list ## Timeline 1. ID reserved Apr 23, 2021 2. Record published Jun 15, 2021 3. Record last updated Aug 3, 2024 ## Look up another CVE ## About CubePath CubePath is a cloud provider with data centers in Europe and the United States. It offers VPS, bare metal servers and DDoS protection. [Cloud VPS](https://cubepath.com/vps) [DDoS protection](https://cubepath.com/ddos-protection) Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Data as of Nov 10, 2026, 20:05 UTC. [Sources and licenses](https://cubepath.com/security/cve/legal)