CVE-2021-26690: Apache HTTP Server mod_session NULL pointer dereference via Cookie header

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote denial of service with a high EPSS score against a widely deployed web server, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

Apache HTTP Server versions 2.4.0 through 2.4.46 mishandle a specially crafted Cookie header in mod_session, causing a NULL pointer dereference. The result is a crash of the server process, which an unauthenticated remote client can trigger repeatedly to deny service.

Impact

An attacker can crash the affected Apache HTTP Server process, disrupting availability for all users served by that instance. No confidentiality or integrity impact is described; the effect is denial of service only.

Attack surface

Reachable over the network by sending a crafted Cookie header to a server where mod_session is in use; the CVSS vector shows no privileges or user interaction required. The record does not state which specific mod_session configuration is required to expose the flaw.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at roughly 0.65 (99th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Upgrade Apache HTTP Server to a release after 2.4.46 that contains the fix, or apply the vendor patch for your distribution.
• If mod_session is not needed, disable it to remove the vulnerable code path.
• Apply available Debian, Fedora, Gentoo, NetApp and Oracle updates for affected packages and appliances.
• Where patching is delayed, use a reverse proxy or WAF rule to filter malformed Cookie headers, understanding this is a stopgap.
• Monitor server processes for repeated crashes and restart loops tied to HTTP requests.

Detection

• Alert on Apache httpd child process crashes or restarts correlated with inbound requests carrying unusual Cookie headers.
• Review web server logs for repeated requests with malformed or oversized Cookie values from single sources.
• Track httpd core dumps or segfault entries in system logs and correlate with source IPs.
• Watch for availability degradation or connection failures on hosts running unpatched Apache 2.4.0 to 2.4.46.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.