CVE-2021-34798CWE-476

CVE-2021-34798: vulnerability in Apache HTTP Server

NULL pointer dereference in httpd core

Published · Updated

Follow this CVE+ Monitor Apache HTTP Server+ Monitor apache2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

15Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 65%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products (13 components)
Red Hat JBoss Enterprise Application Platform 6 · Red Hat Enterprise Linux 6
workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example.
Fixed
12 products (333 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat JBoss Core Services on RHEL 8 · Red Hat JBoss Core Services on RHEL 7 Server · Red Hat Enterprise Linux Server (v. 7) · Red Hat Software Collections for RHEL Workstation(v. 7) · and others 7
fix ↗
Not affected
1 product (12 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 9
Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
Affected products
Apache Software Foundation · Apache HTTP Server
Related CVEs — Apache HTTP Server

In the same product, most dangerous first.

CVE-2021-40438CRITICALmod_proxy SSRFEPSS 100.0%KEVCVE-2021-41773HIGHPath traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49EPSS 100.0%KEVCVE-2021-42013CRITICALPath Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)EPSS 100.0%KEVCVE-2024-38475CRITICALApache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.EPSS 100.0%KEVCVE-2021-44790—Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlierEPSS 96.8%CVE-2017-9798—CVE-2017-9798EPSS 94.7%