CVE-2018-1302: Null Pointer Dereference
Last updated 25 August 2025
Other sources
When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerabilty hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.
Versions Affected: httpd 2.4.17 to 2.4.29
External references:
https://httpd.apache.org/security/vulnerabilities24.html
— Red Hat
When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-1302?
CVE-2018-1302 is a vulnerability in the Apache HTTP Server prior to version 2.4.30.
How severe is CVE-2018-1302?
CVE-2018-1302 has a severity score of 5.9, which is considered medium.
Which software versions are affected by CVE-2018-1302?
CVE-2018-1302 affects Apache HTTP Server versions prior to 2.4.30.
What is the remedy for CVE-2018-1302?
To fix CVE-2018-1302, upgrade to Apache HTTP Server version 2.4.30 or later.
Where can I find more information about CVE-2018-1302?
You can find more information about CVE-2018-1302 at the following references: - [Apache HTTP Server Security Vulnerabilities](https://httpd.apache.org/security/vulnerabilities_24.html) - [Red Hat Bugzilla #1560627](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1560627) - [Red Hat Bugzilla #1561570](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1561570)