mod_session NULL pointer dereference
CVE-2021-26690
7.5HIGH
Key Information
- Vendor
- Apache
- Status
- Apache Http Server
- Vendor
- CVE Published:
- 10 June 2021
Badges
πΎ Exploit Existsπ‘ Public PoCπ£ EPSS 81%
Summary
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service
Affected Version(s)
Apache HTTP Server = 2.4.46
Apache HTTP Server = 2.4.43
Apache HTTP Server = 2.4.41
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
EPSS Score
81% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
- π‘
Public PoC available
- πΎ
Exploit known to exist
Vulnerability published
Vulnerability Reserved
Collectors
NVD DatabaseMitre Database3 Proof of Concept(s)
Credit
This issue was discovered and reported by GHSL team member @antonio-morales (Antonio Morales)