CVE-2017-3169

Critical

Published: 20/06/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In Apache httpd versions 2.2.x before 2.2.33 and 2.4.x before 2.4.26, the mod_ssl module may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.

Risk Assessment

An attacker may exploit this vulnerability to cause a server crash, potentially leading to service downtime. This could affect the availability of applications relying on the Apache server.

Recommendation

It is recommended to upgrade Apache httpd to version 2.2.33 or 2.4.26 or later to mitigate this vulnerability.

Original NVD description (English source)

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.