CVE-2021-34798: Apache HTTP Server NULL pointer dereference via malformed requests

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote denial of service with a high EPSS score, though limited to availability impact and not listed in KEV.

What it is

Apache HTTP Server 2.4.48 and earlier can dereference a NULL pointer when handling malformed requests, causing the server process to crash. Because the trigger is a network request and no credentials are required, any reachable instance is exposed to trivial denial of service.

Impact

An unauthenticated attacker can crash the affected server process, disrupting availability of hosted services. The CVSS vector shows availability impact only, with no confidentiality or integrity loss.

Attack surface

Reached over the network by sending malformed HTTP requests to the server; the CVSS vector indicates no authentication and no user interaction are required. Any internet- or network-exposed Apache HTTP Server 2.4.48 or earlier is in scope.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is high at roughly 0.645 (99.2nd percentile), indicating elevated likelihood of attempted exploitation. References are vendor advisories and third-party patches, with no public exploit tag supplied.

What to do

• Upgrade Apache HTTP Server to a version later than 2.4.48 per the Apache vendor advisory.
• Apply vendor patches for downstream distributions and products (Debian, Fedora, Oracle, NetApp, Siemens, Tenable) that bundle the affected server.
• Restrict network exposure of Apache HTTP Server instances where feasible and place them behind filtering or rate-limiting controls.
• Monitor for repeated server process crashes and restart loops as an indicator of attempted exploitation.

Detection

• Alert on Apache HTTP Server process crashes or unexpected restarts correlated with inbound HTTP traffic.
• Review web server error and access logs for malformed request patterns preceding crashes.
• Track availability gaps or 5xx spikes on Apache-hosted services that could indicate denial-of-service attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.