CVE-2021-31618

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

• ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
• AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
• Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

51.49% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 98.8% of scored records. A rank, not a probability.

NVD base score

7.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2021-06-15 00:00Z5 YR AGO

Last updated

2024-08-03 23:03Z2 YR AGO

Reserved

2021-04-23

Assigning CNA

apache

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

• CWE-476NULL Pointer DereferenceBase

Data version

5.1

Document digest

6b723a672d80183d82d5c5a40ad277e036433762a3ab7c4b43e16e932a4c2fae

• httpd.apache.orghttp://httpd.apache.org/security/vulnerabilities_24.html
• www.openwall.com[oss-security] 20210609 CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 requesthttp://www.openwall.com/lists/oss-security/2021/06/10/9mailing-list
• seclists.orghttps://seclists.org/oss-sec/2021/q2/206
• lists.apache.org[httpd-cvs] 20210615 svn commit: r1890801 - /httpd/site/trunk/content/security/json/CVE-2021-31618.jsonhttps://lists.apache.org/thread.html/r14b66ef0f4f569fd515a3f96cd4eb58bd9a8ff525cc326bb0359664f%40%3Ccvs.httpd.apache.org%3Emailing-list
• lists.apache.org[httpd-cvs] 20210615 svn commit: r1075782 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/r783b6558abf3305b17ea462bed4bd66d82866438999bf38cef6d11d1%40%3Ccvs.httpd.apache.org%3Emailing-list
• lists.fedoraproject.orgFEDORA-2021-051639aad4https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NKJ3ZA3FTSZ2QBBPKS6BYGAWYRABNQQ/vendor-advisory
• lists.fedoraproject.orgFEDORA-2021-181f29c392https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A73QJ4HPUMU26I6EULG6SCK67TUEXZYR/vendor-advisory
• lists.debian.org[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security updatehttps://lists.debian.org/debian-lts-announce/2021/07/msg00006.htmlmailing-list
• www.debian.orgDSA-4937https://www.debian.org/security/2021/dsa-4937vendor-advisory
• security.gentoo.orgGLSA-202107-38https://security.gentoo.org/glsa/202107-38vendor-advisory
• www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.html
• security.netapp.comhttps://security.netapp.com/advisory/ntap-20210727-0008/
• www.openwall.com[oss-security] 20240313 Re: CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 requesthttp://www.openwall.com/lists/oss-security/2024/03/13/2mailing-list