CVE-2024-38477: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request

[Eric Covener <covener () apache org>]

Severity: important

Affected versions:

- Apache HTTP Server 2.4.0 through 2.4.59

Description:

null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server 
via a malicious request.
Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Credit:

Orange Tsai (@orange_8361) from DEVCORE (finder)

References:

https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-38477

Timeline:

2024-04-01: Reported