AI analysis
A NULL pointer dereference (CWE-476) in the mod_xml2enc module of Apache HTTP Server before 2.4.69 can crash the server. It is triggered when an untrusted backend, reached through a proxy, returns a response whose charset conversion partially succeeds and then fails. The result is a denial of service on all platforms, not code execution or data theft. Any deployment running a vulnerable release with mod_xml2enc processing proxied responses from an untrusted backend is affected. There is no known public proof of concept, the issue is not on the CISA KEV list, and CVSS has not yet been scored.
What to do: Upgrade Apache HTTP Server to 2.4.69 or later. Until then, unload mod_xml2enc (check with httpd -M or apachectl -M) or stop using it to recode responses from backends you do not trust, and restart httpd after the change.
Affected
| Apache Software Foundation Apache HTTP Server | before 2.4.69 (all platforms) |
Estimated exposure
massmillions of Apache HTTP Server installs; a smaller subset that proxies via mod_xml2enc to untrusted backends is actually triggerable — Apache HTTP Server is one of the most widely deployed web servers; public web surveys and internet scans have long shown millions of sites and well over 100,000 exposed servers, but this bug only triggers where mod_xml2enc is used to…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4.69, which fixes this issue.