Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HApache HTTP Server
APPApache≤ 2.4.48Broadcom Brocade Fabric Operating System Firmware
OSBroadcomall versionsDebian
OSDebian10.011.09.0Fedora Project Fedora
OSFedoraproject3435Netapp Cloud Backup
APPNetappall versionsNetapp Clustered Data Ontap
APPNetappall versionsNetapp Storagegrid
APPNetappall versionsOracle Communications Cloud Native Core Network Function Cloud Native Environment
APPOracle1.10.0Oracle Enterprise Manager Base Platform
APPOracle13.4.0.013.5.0.0Oracle HTTP Server
APPOracle12.2.1.3.012.2.1.4.0Oracle Instantis Enterprisetrack
APPOracle17.117.217.3Oracle Peoplesoft Enterprise Peopletools
APPOracle8.58Oracle Zfs Storage Appliance Kit
APPOracle8.8Siemens Ruggedcom Nms
APPSiemensall versionsSiemens Sinec Nms
APPSiemensall versionsSiemens Sinema Remote Connect Server
APPSiemens< 3.1Siemens Sinema Server
APPSiemens14.0Tenable Tenable.sc
APPTenable≤ 5.19.1
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
References
Related vulnerabilities
CVE-2026-35273CRITICAL9.8⚠ KEVPL ✓same product
Pominięcie uwierzytelnienia w Oracle PeopleSoft PeopleTools (RCE/Takeover)
CVE-2026-24061CRITICAL9.8⚠ KEVPL ✓same product
GNU Inetutils telnetd: ominięcie uwierzytelnienia przez zmienną USER
CVE-2026-21962CRITICAL10.0⚠ KEVPL ✓same product
Auth Bypass w Oracle HTTP Server i WebLogic Server Proxy Plug-in (CVSS 10.0)
CVE-2025-32463CRITICAL9.3⚠ KEVPL ✓same product
Sudo: eskalacja uprawnień do root poprzez opcję --chroot (CVE-2025-32463)
CVE-2025-49113CRITICAL9.9⚠ KEVPL ✓same product
RCE przez deserializację PHP w Roundcube Webmail (parametr _from)