What’s Vulnerable › Vulnerabilities
CVE-2018-1302
- Severity: medium (CVSS 5.9 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 12.9% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-03-26 · updated 2026-06-17
- Weakness: CWE-476
Description
When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.
Affected products
- Apache HTTP Server: through 2.4.29
- Canonical Ubuntu Linux: 18.04
- Clustered Data ONTAP: all versions
- NetApp Santricity Cloud Connector: all versions
- NetApp Storage Automation Store: all versions
- NetApp StorageGRID: all versions
References
- http://www.openwall.com/lists/oss-security/2018/03/24/5
- http://www.securityfocus.com/bid/103528
- http://www.securitytracker.com/id/1040567
- https://access.redhat.com/errata/RHSA-2019:0366
- https://access.redhat.com/errata/RHSA-2019:0367
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
Get alerted when CVE-2018-1302 or the next vulnerability affects your stack