Vulnerability record · CVE-2021-31618 · published 15 June 2021
CVE-2021-31618: Apache HTTP Server mod_http2 NULL pointer dereference DoS
Apache · Http Server
The HTTP/2 protocol handler in Apache HTTP Server fails to fully initialise a rejection response when a request header violates configured size limits, if that header is the first received or appears in a footer. This causes a NULL pointer dereference that reliably crashes the child process. The flaw affected mod_http2 1.15.17 and Apache HTTP Server 2.4.47, which was never released.
Description
Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityRemote, unauthenticated, low-complexity availability impact with a high EPSS score, though the affected release was never shipped and no KEV listing exists.
What it is
The HTTP/2 protocol handler in Apache HTTP Server fails to fully initialise a rejection response when a request header violates configured size limits, if that header is the first received or appears in a footer. This causes a NULL pointer dereference that reliably crashes the child process. The flaw affected mod_http2 1.15.17 and Apache HTTP Server 2.4.47, which was never released.
Impact
An attacker can crash the affected child process, causing a denial of service. There is no confidentiality or integrity impact; only availability is affected.
Attack surface
Reachable remotely over the network via a crafted HTTP/2 request; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The trigger is an oversized or otherwise non-compliant header sent as the first header or within a footer.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented. EPSS is high (0.51489, 98.89th percentile), and the description states the triggering request is easy to craft, but no public exploit code is confirmed in the record.
What to do
- Upgrade to a fixed Apache HTTP Server release; note that 2.4.47 was never released, so apply the vendor's corrected version or patch.
- If HTTP/2 is not required, disable mod_http2 or the HTTP/2 protocol to remove the attack path.
- Apply distribution vendor updates for Debian, Fedora, Gentoo and other listed packages.
- Monitor for repeated child process crashes and restart loops on HTTP/2-enabled servers.
Detection
- Alert on Apache child process crashes or segfaults correlated with HTTP/2 traffic.
- Inspect HTTP/2 request logs for oversized headers sent as the first header or within trailers.
- Track unexpected httpd process restarts or worker exhaustion on HTTP/2 listeners.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-31618 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-31618), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
