Every CVE Search/ Get API key

CVE-2021-41524

null pointer dereference in h2 fuzzing

7.5 HighFix available

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

25.8%Up 25.2 points since Oct 6, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

Record
CVE-2021-41524
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

null pointer dereference in h2 fuzzing

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

Record
CVE-2021-41524
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2021-28543 No score

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

Record
EUVD-2021-28543
Updated
2026-11-03
GitHub AdvisoriesGHSA-f29c-hjcq-ww2f 7.5

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request...

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

Record
GHSA-f29c-hjcq-ww2f
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVALPINE-CVE-2021-41524 7.5

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

Record
ALPINE-CVE-2021-41524
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2021-41524 7.5

CVE-2021-41524 does not affect BellSoft software

Record
BELL-CVE-2021-41524
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSV 7.5

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

Record
CVE-2021-41524
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-41524 7.5

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

Record
DEBIAN-CVE-2021-41524
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2022:7143 8.1

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 security update

Record
RHSA-2022:7143
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-apache-2021-41524 No score

null pointer dereference in h2 fuzzing

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

Record
BIT-apache-2021-41524
Updated
2026-11-02
OSVMGASA-2021-0461 No score

Updated apache packages fix security vulnerabilities

The updated packages fix a security vulnerabilities:

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project (CVE-2021-41524).

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions (CVE-2021-41773).

Record
MGASA-2021-0461
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Alpine:v3.11
 before 2.4.50-r0
2.4.50-r0
apache2
Alpine:v3.12
 before 2.4.50-r0
2.4.50-r0
apache2
Alpine:v3.13
 before 2.4.50-r0
2.4.50-r0
apache2
Alpine:v3.14
 before 2.4.50-r0
2.4.50-r0
apache2
Alpine:v3.15
 before 2.4.50-r0
2.4.50-r0
apache2
Alpine:v3.16
 before 2.4.50-r0
2.4.50-r0
apache2
Alpine:v3.17
 before 2.4.50-r0
2.4.50-r0
apache2
Alpine:v3.18
 before 2.4.50-r0
2.4.50-r0
apache2
Alpine:v3.19
 before 2.4.50-r0
2.4.50-r0
apache2
Alpine:v3.20
 before 2.4.50-r0
2.4.50-r0
Show 34 moreShow less
Affected packages
PackageAffectedFixed
apache2
Alpine:v3.21
 before 2.4.50-r0
2.4.50-r0
apache2
Alpine:v3.22
 before 2.4.50-r0
2.4.50-r0
apache2
Alpine:v3.23
 before 2.4.50-r0
2.4.50-r0
apache2
Alpine:v3.24
 before 2.4.50-r0
2.4.50-r0
apache
Bitnami
 2.4.49 up to 2.4.50
2.4.50
apache2
Debian:12
 before 2.4.50-1
2.4.50-1
apache2
Debian:13
 before 2.4.50-1
2.4.50-1
apache2
Debian:14
 before 2.4.50-1
2.4.50-1
apache
Mageia:8
From an advisory covering 2 CVEs
 before 2.4.50-1.mga8
2.4.50-1.mga8
jbcs-httpd24-httpd
Red Hat:jboss_core_services:1::el7
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el7jbcs
0:2.4.51-28.el7jbcs
jbcs-httpd24-httpd-debuginfo
Red Hat:jboss_core_services:1::el7
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el7jbcs
0:2.4.51-28.el7jbcs
jbcs-httpd24-httpd-devel
Red Hat:jboss_core_services:1::el7
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el7jbcs
0:2.4.51-28.el7jbcs
jbcs-httpd24-httpd-manual
Red Hat:jboss_core_services:1::el7
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el7jbcs
0:2.4.51-28.el7jbcs
jbcs-httpd24-httpd-selinux
Red Hat:jboss_core_services:1::el7
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el7jbcs
0:2.4.51-28.el7jbcs
jbcs-httpd24-httpd-tools
Red Hat:jboss_core_services:1::el7
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el7jbcs
0:2.4.51-28.el7jbcs
jbcs-httpd24-mod_ldap
Red Hat:jboss_core_services:1::el7
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el7jbcs
0:2.4.51-28.el7jbcs
jbcs-httpd24-mod_proxy_html
Red Hat:jboss_core_services:1::el7
From an advisory covering 5 CVEs
 before 1:2.4.51-28.el7jbcs
1:2.4.51-28.el7jbcs
jbcs-httpd24-mod_session
Red Hat:jboss_core_services:1::el7
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el7jbcs
0:2.4.51-28.el7jbcs
jbcs-httpd24-mod_ssl
Red Hat:jboss_core_services:1::el7
From an advisory covering 5 CVEs
 before 1:2.4.51-28.el7jbcs
1:2.4.51-28.el7jbcs
jbcs-httpd24-httpd
Red Hat:jboss_core_services:1::el8
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el8jbcs
0:2.4.51-28.el8jbcs
jbcs-httpd24-httpd-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el8jbcs
0:2.4.51-28.el8jbcs
jbcs-httpd24-httpd-devel
Red Hat:jboss_core_services:1::el8
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el8jbcs
0:2.4.51-28.el8jbcs
jbcs-httpd24-httpd-manual
Red Hat:jboss_core_services:1::el8
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el8jbcs
0:2.4.51-28.el8jbcs
jbcs-httpd24-httpd-selinux
Red Hat:jboss_core_services:1::el8
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el8jbcs
0:2.4.51-28.el8jbcs
jbcs-httpd24-httpd-tools
Red Hat:jboss_core_services:1::el8
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el8jbcs
0:2.4.51-28.el8jbcs
jbcs-httpd24-httpd-tools-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el8jbcs
0:2.4.51-28.el8jbcs
jbcs-httpd24-mod_ldap
Red Hat:jboss_core_services:1::el8
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el8jbcs
0:2.4.51-28.el8jbcs
jbcs-httpd24-mod_ldap-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el8jbcs
0:2.4.51-28.el8jbcs
jbcs-httpd24-mod_proxy_html
Red Hat:jboss_core_services:1::el8
From an advisory covering 5 CVEs
 before 1:2.4.51-28.el8jbcs
1:2.4.51-28.el8jbcs
jbcs-httpd24-mod_proxy_html-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 5 CVEs
 before 1:2.4.51-28.el8jbcs
1:2.4.51-28.el8jbcs
jbcs-httpd24-mod_session
Red Hat:jboss_core_services:1::el8
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el8jbcs
0:2.4.51-28.el8jbcs
jbcs-httpd24-mod_session-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 5 CVEs
 before 0:2.4.51-28.el8jbcs
0:2.4.51-28.el8jbcs
jbcs-httpd24-mod_ssl
Red Hat:jboss_core_services:1::el8
From an advisory covering 5 CVEs
 before 1:2.4.51-28.el8jbcs
1:2.4.51-28.el8jbcs
jbcs-httpd24-mod_ssl-debuginfo
Red Hat:jboss_core_services:1::el8
From an advisory covering 5 CVEs
 before 1:2.4.51-28.el8jbcs
1:2.4.51-28.el8jbcs

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-41524 is a high vulnerability (CVSS 7.5) in Apache Http Server, published October 5, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 25.8%, the 97th percentile. Fixed in apache2 2.4.50-r0.

References

Show 37 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open