Skip to content
Fencer Vulns
medium 5.9

CVE-2018-1302 json

When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer p…

published 2018-03-26 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-11910

cvss
5.9
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
12.9%
EPSS 12.9% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.

Patch / fix

  • apache2 Debian 14, Debian 13, Debian 12 2.4.33-1

debian advisories DEBIAN-CVE-2018-1302

  • apache2 Ubuntu 18.04 LTS 2.4.29-1ubuntu4.4

ubuntu advisories UBUNTU-CVE-2018-1302

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • jbcs-httpd24 jboss core services 1 1-6.jbcs.el6
  • jbcs-httpd24 jboss core services 1 1-6.jbcs.el7
  • jbcs-httpd24-apr jboss core services 1 1.6.3-31.jbcs.el6
  • jbcs-httpd24-apr jboss core services 1 1.6.3-31.jbcs.el7
  • jbcs-httpd24-httpd jboss core services 1 2.4.29-35.jbcs.el6
  • jbcs-httpd24-httpd jboss core services 1 2.4.29-35.jbcs.el7
  • jbcs-httpd24-mod_jk jboss core services 1 1.2.46-1.redhat_1.jbcs.el6
  • jbcs-httpd24-mod_jk jboss core services 1 1.2.46-1.redhat_1.jbcs.el7

red hat advisories RHSA-2019:0367

  • apache2 SLES 12 SP3, SLES 12 SP2-BCL, SLE Software Development Kit 12 SP3 +4 more 2.4.23-29.18.2

suse advisories SUSE-SU-2018:1161-2SUSE-SU-2018:1161-1

  • apache2 Alpine 3.24, Alpine 3.23, Alpine 3.22 +18 more 2.4.33-r0

alpine advisories ALPINE-CVE-2018-1302

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • apache Arch Linux 2.4.33-1

arch linux advisories AVG-664

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1302 updated cvss 5.9

httpd: Use-after-free on HTTP/2 stream shutdown

  • Red Hat JBoss Core Services
    fixed: vendor fix RHSA-2019:0366
  • Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24 1-6.jbcs.el6, jbcs-httpd24-runtime 1-6.jbcs.el6, jbcs-httpd24-apr 1.6.3-31.jbcs.el6, jbcs-httpd24-httpd 2.4.29-35.jbcs.el6, jbcs-httpd24-nghttp2 1.29.0-9.jbcs.el6, jbcs-httpd24-apr-util 1.6.1-24.jbcs.el6, +22 more Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24 1-6.jbcs.el7, jbcs-httpd24-runtime 1-6.jbcs.el7, jbcs-httpd24-apr 1.6.3-31.jbcs.el7, jbcs-httpd24-httpd 2.4.29-35.jbcs.el7, jbcs-httpd24-nghttp2 1.29.0-9.jbcs.el7, jbcs-httpd24-apr-util 1.6.1-24.jbcs.el7, +22 more
    fixed: vendor fix RHSA-2019:0367
  • Red Hat Enterprise Linux 5 httpd Red Hat Enterprise Linux 6 httpd, mod_ssl, httpd-tools, httpd-manual Red Hat Enterprise Linux 7 httpd, mod_ssl, mod_ldap, httpd-tools, mod_session, httpd-manual, +1 more Red Hat Enterprise Linux 8 httpd, mod_md, mod_ssl, mod_ldap, mod_http2, httpd-tools, +4 more Red Hat JBoss Enterprise Web Server 2 jbcs-httpd24, jbcs-httpd24-runtime Red Hat JBoss Web Server 3 httpd24
    +2 more products
    Red Hat Mobile Application Platform 4 rhmap-httpd-docker Red Hat Software Collections httpd24-httpd, httpd24-mod_md, httpd24-mod_ssl, httpd24-mod_ldap, httpd24-httpd-tools, httpd24-mod_session, +2 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

12.94% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected products

  • Apache Software Foundation Apache HTTP Server

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.