Vulnerability record · CVE-2020-13950 · published 10 June 2021
CVE-2020-13950: Apache HTTP Server mod_proxy_http NULL pointer dereference DoS
Apache · Http Server
Apache HTTP Server 2.4.41 through 2.4.46 mod_proxy_http can be crashed via a NULL pointer dereference when a specially crafted request uses both Content-Length and Transfer-Encoding headers. The flaw is a remotely reachable denial of service against the proxy module, and the affected version range is narrow and documented.
Description
Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityRemote unauthenticated denial of service with a high EPSS score, though no KEV listing or known public exploit is recorded.
What it is
Apache HTTP Server 2.4.41 through 2.4.46 mod_proxy_http can be crashed via a NULL pointer dereference when a specially crafted request uses both Content-Length and Transfer-Encoding headers. The flaw is a remotely reachable denial of service against the proxy module, and the affected version range is narrow and documented.
Impact
An unauthenticated attacker can crash the affected server process, causing a denial of service. There is no confidentiality or integrity impact per the CVSS vector.
Attack surface
Reached over the network by sending crafted HTTP requests to a server that proxies requests through mod_proxy_http; no authentication or user interaction is required per the CVSS vector AV:N/PR:N/UI:N.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented; EPSS is high at roughly 0.49 (98.8th percentile), and references are vendor advisories, mailing lists and third-party advisories with no public exploit tag.
What to do
- Upgrade Apache HTTP Server to a version after 2.4.46 that contains the fix, or apply the vendor patch for your distribution.
- If immediate upgrade is not possible, restrict or disable mod_proxy_http where it is not required.
- Place a reverse proxy or WAF in front of affected servers to reject requests carrying both Content-Length and Transfer-Encoding headers.
- Monitor vendor advisories for Debian, Fedora, Oracle, Gentoo and NetApp packages and apply their updated builds.
Detection
- Search web and proxy logs for requests containing both Content-Length and Transfer-Encoding headers.
- Alert on Apache child process crashes or restarts correlated with proxied requests.
- Monitor for repeated 5xx responses or connection resets from mod_proxy_http backends.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-13950 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-13950), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
