CVE-2024-36387
published 2024-07-01CVE-2024-36387: Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading…
PriorityP428medium5.4CVSS 3.1
AVNACLPRLUINSUCNILAL
EPSS
1.71%
74.8th percentile
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | 2.4.55 – 2.4.59 | — |
| apache_software_foundation | apache_http_server | 2.4.55 – 2.4.59 | — |
| debian | apache2 | < apache2 2.4.61-1~deb12u1 (bookworm) | apache2 2.4.61-1~deb12u1 (bookworm) |
| msrc | azl3_httpd_2.4.58-4_on_azure_linux_3.0 | — | — |
| msrc | azl3_httpd_2.4.61-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_httpd_2.4.59-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_httpd_2.4.61-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| netapp | ontap | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
osv5.4MEDIUM
vendor_debian5.4MEDIUM
vendor_msrc5.4MEDIUM
vendor_redhat5.4MEDIUM
vendor_ubuntu5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
apache2 regression
osv·2024-07-11·CVSS 5.4
[MEDIUM] apache2 regression
apache2 regression
USN-6885-1 fixed vulnerabilities in Apache HTTP Server. One of the security
fixes introduced a regression when proxying requests to a HTTP/2 server.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Marc Stern discovered that the Apache HTTP Server incorrectly handled
serving WebSocket protocol upgrades over HTTP/2 connections. A remote
attacker could possibly use this issue to cause the server to crash,
resulting in a denial of service. (CVE-2024-36387)
Orange Tsai discovered that the Apache HTTP Server mod_proxy module
incorrectly sent certain request URLs with incorrect encodings to backends.
A remote attacker could possibly use this issue to bypass authentication.
(CVE-2024-38473)
Orange Tsai discovered that the Apach
OSV
apache2 vulnerabilities
osv·2024-07-08·CVSS 5.4
CVE-2024-36387 [MEDIUM] apache2 vulnerabilities
apache2 vulnerabilities
Marc Stern discovered that the Apache HTTP Server incorrectly handled
serving WebSocket protocol upgrades over HTTP/2 connections. A remote
attacker could possibly use this issue to cause the server to crash,
resulting in a denial of service. (CVE-2024-36387)
Orange Tsai discovered that the Apache HTTP Server mod_proxy module
incorrectly sent certain request URLs with incorrect encodings to backends.
A remote attacker could possibly use this issue to bypass authentication.
(CVE-2024-38473)
Orange Tsai discovered that the Apache HTTP Server mod_rewrite module
incorrectly handled certain substitutions. A remote attacker could possibly
use this issue to execute scripts in directories not directly reachable
by any URL, or cause a denial of service. Some environments
GHSA
GHSA-463r-p989-2f9j: Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, deg
ghsa_unreviewed·2024-07-01
CVE-2024-36387 [MEDIUM] CWE-476 GHSA-463r-p989-2f9j: Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, deg
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.
OSV
CVE-2024-36387: Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, deg
osv·2024-07-01·CVSS 5.4
CVE-2024-36387 [MEDIUM] CVE-2024-36387: Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, deg
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.
Ubuntu
Apache HTTP Server regression
vendor_ubuntu·2024-07-11·CVSS 5.4
[MEDIUM] Apache HTTP Server regression
Title: Apache HTTP Server regression
Summary: USN-6885-1 introduced a regression in Apache HTTP Server.
USN-6885-1 fixed vulnerabilities in Apache HTTP Server. One of the security
fixes introduced a regression when proxying requests to a HTTP/2 server.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Marc Stern discovered that the Apache HTTP Server incorrectly handled
serving WebSocket protocol upgrades over HTTP/2 connections. A remote
attacker could possibly use this issue to cause the server to crash,
resulting in a denial of service. (CVE-2024-36387)
Orange Tsai discovered that the Apache HTTP Server mod_proxy module
incorrectly sent certain request URLs with incorrect encodings to backends.
A remote attacker could possibly use this i
Microsoft
Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2
vendor_msrc·2024-07-09·CVSS 5.4
CVE-2024-36387 [MEDIUM] CWE-476 Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2
Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
apache: apache
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: ht
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2024-07-08·CVSS 5.4
CVE-2024-38475 [MEDIUM] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
Marc Stern discovered that the Apache HTTP Server incorrectly handled
serving WebSocket protocol upgrades over HTTP/2 connections. A remote
attacker could possibly use this issue to cause the server to crash,
resulting in a denial of service. (CVE-2024-36387)
Orange Tsai discovered that the Apache HTTP Server mod_proxy module
incorrectly sent certain request URLs with incorrect encodings to backends.
A remote attacker could possibly use this issue to bypass authentication.
(CVE-2024-38473)
Orange Tsai discovered that the Apache HTTP Server mod_rewrite module
incorrectly handled certain substitutions. A remote attacker could possibly
use this issue to execute scripts in directori
Red Hat
mod_http2: DoS by null pointer in websocket over HTTP/2
vendor_redhat·2024-07-01·CVSS 5.4
CVE-2024-36387 [MEDIUM] CWE-476 mod_http2: DoS by null pointer in websocket over HTTP/2
mod_http2: DoS by null pointer in websocket over HTTP/2
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.
A flaw was found in the Apache HTTP Server. Serving WebSocket protocol upgrades over an HTTP/2 connection could result in a NULL pointer dereference, leading to a crash of the server process.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Package: mod_http2 (Red Hat Enterprise Linux 10) - Not affected
Package: httpd:2.4/mod_http2 (Red Hat Enterprise Linux 8) - Not aff
Debian
CVE-2024-36387: apache2 - Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a N...
vendor_debian·2024·CVSS 5.4
CVE-2024-36387 [MEDIUM] CVE-2024-36387: apache2 - Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a N...
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.
Scope: local
bookworm: resolved (fixed in 2.4.61-1~deb12u1)
bullseye: resolved (fixed in 2.4.61-1~deb11u1)
forky: resolved (fixed in 2.4.60-1)
sid: resolved (fixed in 2.4.60-1)
trixie: resolved (fixed in 2.4.60-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-07-01
Published