Denial of Service Vulnerability in Apache2: CVE-2021-26690
Summary
ALPINE-CVE-2021-26690: Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service. Affects apache2 versions < 2.4.48-r0. Fixed in 2.4.48-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache2, is a widely-used open-source web server software that enables the hosting of websites and applications. It is known for its flexibility, security features, and extensive module support. However, certain versions of Apache2 are vulnerable to a Denial of Service (DoS) attack due to a flaw in the mod_session module, which can be exploited through specially crafted Cookie headers.
Vulnerability Detail
The vulnerability identified as CVE-2021-26690 affects Apache HTTP Server versions 2.4.0 to 2.4.46. It arises from a NULL pointer dereference caused by the handling of a specially crafted Cookie header in the mod_session module. This can lead to a crash of the Apache server, resulting in a Denial of Service. Attackers can exploit this vulnerability to disrupt service availability, impacting users and applications relying on the affected server.
How To Fix
Minimum fixed version
2.4.48-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the mod_session module if it is not critical for your application. This can be done by commenting out the relevant LoadModule directive in your Apache configuration file. For example, you can add a '#' before the line: '#LoadModule session_module modules/mod_session.so'.
Conclusion
CVE-2021-26690 is a significant vulnerability in Apache HTTP Server that can lead to service disruptions. It is crucial for users of affected versions to update to the patched version 2.4.48-r0 or later to ensure the security and availability of their web services. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for apache2 →
FAQ
CVE-2021-26690 is a vulnerability in Apache HTTP Server that can lead to a Denial of Service due to a NULL pointer dereference in the mod_session module.
Apache HTTP Server versions 2.4.0 to 2.4.46 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The CVSS score of CVE-2021-26690 is 7.5, indicating a high severity level.
If immediate updating is not possible, consider disabling the mod_session module as a temporary workaround to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
