CVE-2018-1302

CVE-2018-1302: vulnerability in Apache HTTP Server

Published · Updated

Follow this CVE+ Monitor Apache HTTP Server+ Monitor apache2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 13%
When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.
Affected products
Apache Software Foundation · Apache HTTP Server
Related CVEs — Apache HTTP Server

In the same product, most dangerous first.

CVE-2021-40438CRITICALmod_proxy SSRFEPSS 100.0%KEVCVE-2021-41773HIGHPath traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49EPSS 100.0%KEVCVE-2021-42013CRITICALPath Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)EPSS 100.0%KEVCVE-2024-38475CRITICALApache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.EPSS 100.0%KEVCVE-2021-44790—Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlierEPSS 96.8%CVE-2017-9798—CVE-2017-9798EPSS 95.0%