Loading vulnerability…
Denial of Service in Apache HTTP Server mod_md Challenge Handler
CVE-2018-8011 is a NULL pointer dereference vulnerability in the mod_md challenge handler in Apache HTTP Server 2.4.33. Specially crafted HTTP requests cause the handler to dereference a NULL pointer, resulting in a segmentation fault in a server child process and potentially denying service. The vulnerability was fixed in Apache HTTP Server 2.4.34.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote attackers can crash Apache HTTP Server child processes and disrupt HTTP service availability. Repeated exploitation can cause recurring process failures and denial of service. Core dumps may be generated, depending on system configuration.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, reduce exposure by disabling mod_md or any affected ACME/challenge handling functionality until the server can be updated. Restrict untrusted access to the vulnerable HTTP endpoints where feasible and monitor for repeated malformed or crafted requests that may indicate exploitation attempts. The available information does not provide a more specific vendor-recommended workaround beyond upgrading.
Patch, then assume compromise.
Upgrade Apache HTTP Server 2.4.33 to version 2.4.34 or a later supported release containing the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.