{"id":"CVE-2018-8011","aliases":["ALPINE-CVE-2018-8011","BELL-CVE-2018-8011","DEBIAN-CVE-2018-8011","EUVD-2018-19719","SUSE-SU-2018:2424-1","UBUNTU-CVE-2018-8011"],"status":"published","title":"mod_md, DoS via Coredumps on specially crafted requests","description":"By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.5533,"percentile":0.99038,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2018-07-18T14:00:00Z","modified":"2026-10-24T10:30:33Z","exploits":[{"source":"nuclei","id":"CVE-2018-8011","title":"Apache HTTP Server - NULL Pointer Dereference","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2018/CVE-2018-8011.yaml"}],"fixes":[{"ecosystem":"Alpine:v3.10","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"apache2","fixed_in":["2.4.34-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"apache2","fixed_in":["2.4.34-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache2","fixed_in":["2.4.34-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache2","fixed_in":["2.4.34-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.34-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.33-3.3.1"}]}],"bundled":2}],"products":[{"vendor":"apache","product":"http_server"},{"vendor":"apache software foundation","product":"apache http server"},{"vendor":"netapp","product":"cloud_backup"}],"references":[{"url":"http://www.securitytracker.com/id/1041401","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20180926-0007/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-8011","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-8011","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-8011","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-8011","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182424-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1101688","tags":["report"]},{"url":"https://bugzilla.suse.com/1101689","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8011","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-8011","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2018/07/18/2","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-8011","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-8011","title":"mod_md, DoS via Coredumps on specially crafted requests","description":"By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).","status":"published","published":"2018-07-18T14:00:00Z","modified":"2024-09-16T22:30:24.315Z","updated_at":"2026-11-02T14:35:04.172099Z"}],"euvd":[{"id":"EUVD-2018-19719","description":"By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).","status":"published","published":"2018-07-18T14:00:00Z","modified":"2024-09-16T22:30:24Z","updated_at":"2026-11-03T00:55:02.424132Z"}],"nvd":[{"id":"CVE-2018-8011","description":"By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).","status":"published","published":"2018-07-18T14:29:00.307Z","modified":"2026-06-17T02:04:04.877Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:04:33.865124Z"}],"osv":[{"id":"ALPINE-CVE-2018-8011","description":"By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).","status":"published","published":"2018-07-18T14:29:00.307Z","modified":"2026-10-23T17:17:55.300280194Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2018-8011","title":"CVE-2018-8011 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:22.986445Z","modified":"2026-01-26T09:47:50.866767Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-8011","description":"By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).","status":"published","published":"2018-07-18T14:29:00.307Z","modified":"2026-10-24T10:30:33.117782217Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-8011","description":"By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).","status":"published","published":"2018-07-18T14:29:00.307Z","modified":"2026-10-23T18:03:09.263750393Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"UBUNTU-CVE-2018-8011","description":"By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).","status":"withdrawn","published":"2018-07-18T14:29:00Z","modified":"2025-07-16T08:14:12.968681Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"SUSE-SU-2018:2424-1","title":"Security update for apache2","description":"This update for apache2 fixes the following issues:\n\nThe following security vulnerabilities were fixed:\n\n- CVE-2018-1333: Fixed a worker exhaustion that could have lead to a denial\n  of service via specially crafted HTTP/2 requests (bsc#1101689).\n- CVE-2018-8011: Fixed a null pointer dereference in mod_md, which could have\n  lead to a denial of service via specially crafted HTTP requests (bsc#1101688).\n  Note: We are currently not shipping this modules, since it is still considered\n  experimental, but we might start to ship it with future releases.\n","status":"published","published":"2018-08-17T16:21:39Z","modified":"2025-05-02T04:07:43.893329Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}