CVE-2014-3581: apache http_server NULL Pointer Dereference
Vulnerability summary
CVE-2014-3581 is a medium (CVSS 5.0) NULL Pointer Dereference vulnerability in apache http_server. EPSS estimates a 13.56% chance of exploitation in the next 30 days, higher than 96.4% of scored vulnerabilities.
Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 9 · Related 3Timeline
- 10-10-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty HTTP Content-Type header.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
13.56%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
No change 0.00 pp
From 13.56% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Redhat5 products
- enterprise_linux_desktop7.0
- enterprise_linux_eus7.3 | 7.4 | 7.5 | 7.6 | 7.7
- enterprise_linux_server7.0
- enterprise_linux_server_aus7.3 | 7.4 | 7.6 | 7.7
- enterprise_linux_server_tus7.3 | 7.6 | 7.7
Oracle2 products
- enterprise_manager_ops_center< 12.1.4 | 12.2.0 | 12.2.1 | 12.3.0
- linuxEOL6
Apache1 product
- http_server2.4.1 | 2.4.2 | 2.4.3 | 2.4.4 | 2.4.6 | 2.4.7 | 2.4.9 | 2.4.10
Canonical1 product
- ubuntu_linuxEOL10.04 | 12.04 | 14.04 | 14.10
Debian1 product
- apache2< 2.4.10-3
Ubuntu1 product
- apache2< 2.4.7-1ubuntu4.4
6 vendors · 11 products
References
33 links- www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlX Refsource CONFIRMThird Party Advisory
- www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlX Refsource CONFIRMThird Party Advisory
- svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/CHANGES?view=markup&pathrev=1627749X Refsource CONFIRMRelease NotesVendor Advisory
- lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlVendor AdvisoryX Refsource APPLEBroken LinkMailing List
Show all 33 references
- bugzilla.redhat.com/show_bug.cgi?id=1149709X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
- lists.apple.com/archives/security-announce/2015/Sep/msg00004.htmlVendor AdvisoryX Refsource APPLEBroken LinkMailing List
