An update of the httpd package has been released.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4257 advisory.

  - httpd: mod_session: NULL pointer dereference when parsing Cookie header (CVE-2021-26690)

  - httpd: Unexpected URL matching with 'MergeSlashes OFF' (CVE-2021-30641)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2774:01 advisory.

    * httpd: mod_session: NULL pointer dereference when parsing Cookie header (CVE-2021-26690)
      * httpd: Unexpected URL matching with 'MergeSlashes OFF' (CVE-2021-30641)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2541:01 advisory.

    httpd: mod_session: NULL pointer dereference when parsing Cookie header     (CVE-2021-26690)         httpd: Unexpected URL matching with 'MergeSlashes OFF' (CVE-2021-30641)         httpd: Regression of CVE-2021-40438 and CVE-2021-26691 fixes in MIRACLE     LINUX 8.4 (CVE-2021-20325)     CVE(s):
    CVE-2021-26690     Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can     cause a NULL pointer dereference and crash, leading to a possible Denial Of Service     CVE-2021-30641     Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'     CVE-2021-20325
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.
    Modularity name: httpd     Stream name: 2.4

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache httpd installed on the remote host is prior to 2.4.47. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.47 changelog:

  - Unexpected <Location> section matching with 'MergeSlashes OFF' (CVE-2021-30641)

  - mod_auth_digest: possible stack overflow by one nul byte while validating the Digest nonce. (CVE-2020-35452)

  - mod_session: Fix possible crash due to NULL pointer dereference, which could be used to cause a Denial of Service     with a malicious backend server and SessionHeader. (CVE-2021-26691)

  - mod_session: Fix possible crash due to NULL pointer dereference, which could be used to cause a Denial of Service.
    (CVE-2021-26690)

  - mod_proxy_http: Fix possible crash due to NULL pointer dereference, which could be used to cause a Denial of     Service. (CVE-2020-13950)

  - Windows: Prevent local users from stopping the httpd process (CVE-2020-13938)

  - mod_proxy_wstunnel, mod_proxy_http: Handle Upgradable protocols end-to-end negotiation. (CVE-2019-17567)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

New httpd packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4994-1 advisory.

    Marc Stern discovered that the Apache mod_proxy_http module incorrectly handled certain requests. A remote     attacker could possibly use this issue to cause Apache to crash, resulting in a denial of service. This     issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2020-13950)

    Antonio Morales discovered that the Apache mod_auth_digest module incorrectly handled certain Digest     nonces. A remote attacker could possibly use this issue to cause Apache to crash, resulting in a denial of     service. (CVE-2020-35452)

    Antonio Morales discovered that the Apache mod_session module incorrectly handled certain Cookie headers.
    A remote attacker could possibly use this issue to cause Apache to crash, resulting in a denial of     service. (CVE-2021-26690)

    Christophe Jaillet discovered that the Apache mod_session module incorrectly handled certain SessionHeader     values. A remote attacker could use this issue to cause Apache to crash, resulting in a denial of service,     or possibly execute arbitrary code. (CVE-2021-26691)

    Christoph Anton Mitterer discovered that the new MergeSlashes configuration option resulted in unexpected     behaviour in certain situations. (CVE-2021-30641)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Apache httpd reports :

- moderate: mod_proxy_wstunnel tunneling of non Upgraded connections (CVE-2019-17567)

- moderate: Improper Handling of Insufficient Privileges (CVE-2020-13938)

- low: mod_proxy_http NULL pointer dereference (CVE-2020-13950)

- low: mod_auth_digest possible stack overflow by one nul byte (CVE-2020-35452)

- low: mod_session NULL pointer dereference (CVE-2021-26690)

- low: mod_session response handling heap overflow (CVE-2021-26691)

- moderate: Unexpected URL matching with 'MergeSlashes OFF' (CVE-2021-30641)

- important: NULL pointer dereference on specially crafted HTTP/2 request (CVE-2021-31618)

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2706 advisory.

    Several vulnerabilities have been found in the Apache HTTP server, which could result in denial of     service. In addition the implementation of the MergeSlashes option could result in unexpected behaviour.
    For Debian 9 stretch, these problems have been fixed in version 2.4.25-3+deb9u10. We recommend that you     upgrade your apache2 packages. For the detailed security status of apache2 please refer to its security     tracker page at: https://security-tracker.debian.org/tracker/apache2 Further information about Debian LTS     security advisories, how to apply these updates to your system and frequently asked questions can be found     at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server     could cause a heap overflow (CVE-2021-26691)

  - Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'     (CVE-2021-30641)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in     mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team     could create one, though some particular compiler and/or compilation option might make it possible, with     limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow     (CVE-2020-35452)

  - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can     cause a NULL pointer dereference and crash, leading to a possible Denial Of Service (CVE-2021-26690)

  - In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server     could cause a heap overflow (CVE-2021-26691)

  - Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'     (CVE-2021-30641)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4257 advisory.

    * httpd: mod_session: NULL pointer dereference when parsing Cookie header (CVE-2021-26690)

    * httpd: Unexpected URL matching with 'MergeSlashes OFF' (CVE-2021-30641)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
153184	Photon OS 3.0: Httpd PHSA-2021-3.0-0257	Nessus	PhotonOS Local Security Checks	2021/9/9	2025/8/22	high
155061	CentOS 8 : httpd:2.4 (CESA-2021:4257)	Nessus	CentOS Local Security Checks	2021/11/11	2021/11/11	medium
294360	MiracleLinux 8 : httpd:2.4 (AXSA:2021-2774:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
294771	MiracleLinux 8 : httpd:2.4 (AXSA:2021-2541:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
150280	Apache 2.4.x < 2.4.47 Multiple Vulnerabilities	Nessus	Web Servers	2021/6/4	2022/4/11	critical
150334	Slackware 14.0 / 14.1 / 14.2 / current : httpd (SSA:2021-158-01)	Nessus	Slackware Local Security Checks	2021/6/8	2021/6/10	critical
150940	Ubuntu 18.04 LTS / 20.04 LTS : Apache HTTP Server vulnerabilities (USN-4994-1)	Nessus	Ubuntu Local Security Checks	2021/6/21	2025/9/3	critical
151010	FreeBSD : Apache httpd -- Multiple vulnerabilities (cce76eca-ca16-11eb-9b84-d4c9ef517024)	Nessus	FreeBSD Local Security Checks	2021/6/25	2023/12/12	critical
151486	Debian DLA-2706-1 : apache2 - LTS security update	Nessus	Debian Local Security Checks	2021/7/9	2025/1/24	critical
153607	EulerOS 2.0 SP8 : httpd (EulerOS-SA-2021-2463)	Nessus	Huawei Local Security Checks	2021/9/24	2021/9/24	critical
153679	EulerOS 2.0 SP9 : httpd (EulerOS-SA-2021-2553)	Nessus	Huawei Local Security Checks	2021/9/27	2021/9/27	critical
158878	AlmaLinux 8 : httpd:2.4 (ALSA-2021:4257)	Nessus	Alma Linux Local Security Checks	2022/3/12	2025/1/13	medium

検出

プラグインの検索

high

medium

medium

critical

critical

critical

critical

critical

critical

critical

critical

medium