CVE-2018-1302: apache software foundation apache http server NULL Pointer Dereference
Vulnerability summary
CVE-2018-1302 is a medium (CVSS 5.9) NULL Pointer Dereference vulnerability in apache software foundation apache http server. EPSS estimates a 12.88% chance of exploitation in the next 30 days, higher than 96.3% of scored vulnerabilities.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 3Timeline
- 26-03-2018PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
12.88%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
No change 0.00 pp
From 12.88% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Netapp4 products
Alpine1 product
- apache2< 2.4.33-r0
Apache1 product
- http_server≤ 2.4.29
Apache software foundation1 product
- apache http server2.4.17 to 2.4.29
Canonical1 product
- ubuntu_linuxEOL18.04
Debian1 product
- apache2< 2.4.33-1
Ubuntu1 product
- apache2< 2.4.29-1ubuntu4.4
7 vendors · 10 products
References
28 links- support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_usX Refsource CONFIRMThird Party Advisory
- www.openwall.com/lists/oss-security/2018/03/24/5Mailing ListX Refsource MLISTThird Party AdvisoryREPORT
Show all 28 references
- www.tenable.com/security/tns-2019-09X Refsource CONFIRM
