{"id":"CVE-2021-41524","aliases":["ALPINE-CVE-2021-41524","BELL-CVE-2021-41524","BIT-apache-2021-41524","DEBIAN-CVE-2021-41524","EUVD-2021-28543","GHSA-f29c-hjcq-ww2f","MGASA-2021-0461","RHSA-2022:7143"],"status":"published","title":"null pointer dereference in h2 fuzzing","description":"While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.25804,"percentile":0.97987,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2021-10-05T08:40:11Z","modified":"2026-10-24T10:30:23Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"apache","fixed_in":["2.4.50"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"apache2","fixed_in":["2.4.50-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache2","fixed_in":["2.4.50-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache2","fixed_in":["2.4.50-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"apache","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.49"},{"fixed":"2.4.50"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-28.el8jbcs"}]}],"bundled":5}],"products":[{"vendor":"apache","product":"http_server"},{"vendor":"apache software foundation","product":"apache http server"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"netapp","product":"cloud_backup"},{"vendor":"oracle","product":"instantis_enterprisetrack"}],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/05/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20211029-0009/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202208-20","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41524","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/"},{"url":"https://github.com/advisories/GHSA-f29c-hjcq-ww2f"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-41524","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-41524","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-41524","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0461.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29530","tags":["report"]},{"url":"https://downloads.apache.org/httpd/Announcement2.4.html","tags":["web"]},{"url":"https://downloads.apache.org/httpd/CHANGES_2.4.50","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2022:7143","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.51/html-single/red_hat_jboss_core_services_apache_http_server_2.4.51_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1966728","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2005119","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2005124","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2010934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034672","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7143.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33193","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33193","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33193","tags":["advisory"]},{"url":"https://portswigger.net/research/http2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-36160","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-36160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36160","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-39275","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39275","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39275","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41524","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41524","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44224","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44224","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44224","tags":["advisory"]},{"url":"http://httpd.apache.org/security/vulnerabilities_24.html","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2021-41524","title":"null pointer dereference in h2 fuzzing","description":"While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.","status":"published","published":"2021-10-05T08:40:11Z","modified":"2024-08-04T03:15:28.45Z","cwes":["CWE-476"],"updated_at":"2026-11-02T14:32:59.105382Z"}],"euvd":[{"id":"EUVD-2021-28543","description":"While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.","status":"published","published":"2021-10-05T08:40:11Z","modified":"2024-08-04T03:15:28Z","updated_at":"2026-11-03T03:24:17.663217Z"}],"ghsa":[{"id":"GHSA-f29c-hjcq-ww2f","title":"While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request...","description":"While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.","status":"published","published":"2022-05-24T19:16:38Z","modified":"2023-01-27T05:03:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:42:13.826528Z"}],"nvd":[{"id":"CVE-2021-41524","description":"While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.","status":"published","published":"2021-10-05T09:15:07.427Z","modified":"2026-06-17T04:08:35.283Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:06:59.314106Z"}],"osv":[{"id":"ALPINE-CVE-2021-41524","description":"While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.","status":"published","published":"2021-10-05T09:15:07.427Z","modified":"2026-10-23T17:17:56.214567097Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"BELL-CVE-2021-41524","title":"CVE-2021-41524 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:22.613238Z","modified":"2026-01-26T09:46:12.775754Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-41524","description":"While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.","status":"published","published":"2021-10-05T09:15:07.427Z","modified":"2026-10-24T10:30:23.716298525Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"DEBIAN-CVE-2021-41524","description":"While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.","status":"published","published":"2021-10-05T09:15:07.427Z","modified":"2026-10-23T18:04:38.681026633Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"RHSA-2022:7143","title":"Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 security update","status":"published","published":"2024-09-13T20:33:46Z","modified":"2026-10-09T10:05:13Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"BIT-apache-2021-41524","title":"null pointer dereference in h2 fuzzing","description":"While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.","status":"published","published":"2024-03-06T10:54:53.365Z","modified":"2026-09-08T08:45:41.20510599Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"MGASA-2021-0461","title":"Updated apache packages fix security vulnerabilities","description":"The updated packages fix a security vulnerabilities:\n\nWhile fuzzing the 2.4.49 httpd, a new null pointer dereference was\ndetected during HTTP/2 request processing, allowing an external source\nto DoS the server. This requires a specially crafted request. The\nvulnerability was recently introduced in version 2.4.49. No exploit is\nknown to the project (CVE-2021-41524).\n\nA flaw was found in a change made to path normalization in Apache HTTP\nServer 2.4.49. An attacker could use a path traversal attack to map URLs\nto files outside the expected document root. If files outside of the\ndocument root are not protected by \"require all denied\" these requests can\nsucceed. Additionally this flaw could leak the source of interpreted files\nlike CGI scripts. This issue is known to be exploited in the wild. This\nissue only affects Apache 2.4.49 and not earlier versions (CVE-2021-41773).\n","status":"published","published":"2021-10-06T14:38:41Z","modified":"2026-04-16T04:42:50.017322603Z","updated_at":"2026-11-02T15:49:41.849028Z"}]}}