CVE-2021-31618

A null pointer de-reference was found in the way httpd handled specially crafted HTTP/2 request. A remote attacker could use this flaw to crash the httpd child process, causing temporary denial of service.

This issue was introduced in httpd via the following commit: https://github.com/icing/mod_h2/commit/1207f69bff3804c7920a57af7649d1eef8b645de#diff-4493820f9733c68fc77b402fc7c57ae05e272e5d3d76deb32b1608c116078313 Versions of httpd package shipped with Red Hat Products do not include this vulnerable code and therefore are not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.