Not rated
CVE-2020-35452 Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in…
Description
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server 2.4 | 2.4.0 → 2.4.46 | No fix stated |
References
- httpd.apache.org httpd.apache.org
- lists.apache.org lists.apache.org
- [httpd-announce] 20210609 CVE-2020-35452: mod_auth_digest possible stack overflow by one nul byte lists.apache.org
- [httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json lists.apache.org
- [oss-security] 20210609 CVE-2020-35452: Apache httpd: mod_auth_digest possible stack overflow by one nul byte www.openwall.com
- [debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update lists.debian.org
- DSA-4937 www.debian.org
- GLSA-202107-38 security.gentoo.org
- FEDORA-2021-dce7e7738e lists.fedoraproject.org
- FEDORA-2021-e3f6dd670d lists.fedoraproject.org
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of Apache HTTP Server
The 139 CVEs of Apache HTTP Server →
CVE-2026-63686
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all…
Not rated
CVE-2026-93546
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write…
Not rated
CVE-2026-79768
Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when…
Not rated
CVE-2026-73637
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows…
Not rated