CVE-2021-31618

Name	CVE-2021-31618
Description	Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2706-1, DSA-4937-1
Debian Bugs	989562

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
apache2 (PTS)	buster	2.4.38-3+deb10u8	fixed
	buster (security)	2.4.38-3+deb10u10	fixed
	bullseye	2.4.56-1~deb11u2	fixed
	bullseye (security)	2.4.56-1~deb11u1	fixed
	bookworm	2.4.57-2	fixed
	trixie	2.4.58-1	fixed
	sid	2.4.59-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
apache2	source	experimental	2.4.48-1
apache2	source	stretch	2.4.25-3+deb9u10	DLA-2706-1
apache2	source	buster	2.4.38-3+deb10u5	DSA-4937-1
apache2	source	(unstable)	2.4.46-5		989562

Notes

https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-31618
https://github.com/apache/httpd/commit/a4fba223668c554e06bc78d6e3a88f33d4238ae4
https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/modules/http2/h2_stream.c?r1=1889759&r2=1889758&pathrev=1889759