CVE-2020-35452 — mod_auth_digest possible stack overflow by one nul byte

Back Back to CVE browser

HIGH

mod_auth_digest possible stack overflow by one nul byte

Published Jun 10, 2021

7.3

HIGH

CVSS 3.1

EPSS 54.81%

Description

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow

Affected products

Vendor Apache Software Foundation Product Apache HTTP Server Default
n/a
- Version
  2.4.0
  Status
  affected
  Constraints
  -
- Version
  2.4.1
  Status
  affected
  Constraints
  -
- Version
  2.4.10
  Status
  affected
  Constraints
  -
- Version
  2.4.12
  Status
  affected
  Constraints
  -
- Version
  2.4.16
  Status
  affected
  Constraints
  -
- Version
  2.4.17
  Status
  affected
  Constraints
  -
- Version
  2.4.18
  Status
  affected
  Constraints
  -
- Version
  2.4.2
  Status
  affected
  Constraints
  -
- Version
  2.4.20
  Status
  affected
  Constraints
  -
- Version
  2.4.23
  Status
  affected
  Constraints
  -
- Version
  2.4.25
  Status
  affected
  Constraints
  -
- Version
  2.4.26
  Status
  affected
  Constraints
  -
- Version
  2.4.27
  Status
  affected
  Constraints
  -
- Version
  2.4.28
  Status
  affected
  Constraints
  -
- Version
  2.4.29
  Status
  affected
  Constraints
  -
- Version
  2.4.3
  Status
  affected
  Constraints
  -
- Version
  2.4.33
  Status
  affected
  Constraints
  -
- Version
  2.4.34
  Status
  affected
  Constraints
  -
- Version
  2.4.35
  Status
  affected
  Constraints
  -
- Version
  2.4.37
  Status
  affected
  Constraints
  -
- Version
  2.4.38
  Status
  affected
  Constraints
  -
- Version
  2.4.39
  Status
  affected
  Constraints
  -
- Version
  2.4.4
  Status
  affected
  Constraints
  -
- Version
  2.4.41
  Status
  affected
  Constraints
  -
- Version
  2.4.43
  Status
  affected
  Constraints
  -
- Version
  2.4.46
  Status
  affected
  Constraints
  -
- Version
  2.4.6
  Status
  affected
  Constraints
  -
- Version
  2.4.7
  Status
  affected
  Constraints
  -
- Version
  2.4.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache HTTP Server

n/a

Version	Status	Constraints
2.4.0	affected	-
2.4.1	affected	-
2.4.10	affected	-
2.4.12	affected	-
2.4.16	affected	-
2.4.17	affected	-
2.4.18	affected	-
2.4.2	affected	-
2.4.20	affected	-
2.4.23	affected	-
2.4.25	affected	-
2.4.26	affected	-
2.4.27	affected	-
2.4.28	affected	-
2.4.29	affected	-
2.4.3	affected	-
2.4.33	affected	-
2.4.34	affected	-
2.4.35	affected	-
2.4.37	affected	-
2.4.38	affected	-
2.4.39	affected	-
2.4.4	affected	-
2.4.41	affected	-
2.4.43	affected	-
2.4.46	affected	-
2.4.6	affected	-
2.4.7	affected	-
2.4.9	affected	-

JBoss Core Services for RHEL 8

jbcs-httpd24-apr-0:1.6.3-107.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-apr-util-0:1.6.1-84.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-curl-0:7.78.0-2.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-httpd-0:2.4.37-78.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_cluster-native-0:1.3.16-9.Final_redhat_2.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_http2-0:1.15.7-21.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_jk-0:1.2.48-20.redhat_1.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_md-1:2.0.8-40.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_security-0:2.9.2-67.GA.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-nghttp2-0:1.39.2-39.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-openssl-1:1.1.1g-8.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-openssl-chil-0:1.0.0-7.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-openssl-pkcs11-0:0.4.10-22.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-apr-0:1.6.3-107.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-apr-util-0:1.6.1-84.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-curl-0:7.78.0-2.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-httpd-0:2.4.37-78.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_cluster-native-0:1.3.16-9.Final_redhat_2.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_http2-0:1.15.7-21.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_jk-0:1.2.48-20.redhat_1.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_md-1:2.0.8-40.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_security-0:2.9.2-67.GA.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-nghttp2-0:1.39.2-39.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-openssl-1:1.1.1g-8.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-openssl-chil-0:1.0.0-7.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-openssl-pkcs11-0:0.4.10-22.jbcs.el7

Fixed · RHSA-2021:4614
Red Hat Enterprise Linux 8

httpd:2.4-8060020220321163517.d63f516d

Fixed · RHSA-2022:1915
Red Hat JBoss Core Services

httpd

Fixed · RHSA-2021:4613
Red Hat Enterprise Linux 6

httpd

Out of support scope
Red Hat Enterprise Linux 7

httpd

Out of support scope
Red Hat Enterprise Linux 9

httpd

Not affected
Red Hat JBoss Enterprise Application Platform 6

httpd22

Out of support scope
Red Hat JBoss Enterprise Web Server 2

httpd22

Out of support scope
Red Hat Software Collections

httpd24-httpd

Fix deferred

Product	Package	State	Advisory
JBoss Core Services for RHEL 8	jbcs-httpd24-apr-0:1.6.3-107.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-apr-util-0:1.6.1-84.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-curl-0:7.78.0-2.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-httpd-0:2.4.37-78.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_cluster-native-0:1.3.16-9.Final_redhat_2.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_http2-0:1.15.7-21.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_jk-0:1.2.48-20.redhat_1.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_md-1:2.0.8-40.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_security-0:2.9.2-67.GA.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-nghttp2-0:1.39.2-39.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-openssl-1:1.1.1g-8.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-openssl-chil-0:1.0.0-7.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-openssl-pkcs11-0:0.4.10-22.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-apr-0:1.6.3-107.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-apr-util-0:1.6.1-84.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-curl-0:7.78.0-2.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-httpd-0:2.4.37-78.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_cluster-native-0:1.3.16-9.Final_redhat_2.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_http2-0:1.15.7-21.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_jk-0:1.2.48-20.redhat_1.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_md-1:2.0.8-40.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_security-0:2.9.2-67.GA.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-nghttp2-0:1.39.2-39.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-openssl-1:1.1.1g-8.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-openssl-chil-0:1.0.0-7.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-openssl-pkcs11-0:0.4.10-22.jbcs.el7	Fixed	RHSA-2021:4614
Red Hat Enterprise Linux 8	httpd:2.4-8060020220321163517.d63f516d	Fixed	RHSA-2022:1915
Red Hat JBoss Core Services	httpd	Fixed	RHSA-2021:4613
Red Hat Enterprise Linux 6	httpd	Out of support scope	n/a
Red Hat Enterprise Linux 7	httpd	Out of support scope	n/a
Red Hat Enterprise Linux 9	httpd	Not affected	n/a
Red Hat JBoss Enterprise Application Platform 6	httpd22	Out of support scope	n/a
Red Hat JBoss Enterprise Web Server 2	httpd22	Out of support scope	n/a
Red Hat Software Collections	httpd24-httpd	Fix deferred	n/a

Remediation

Red Hat statement

This is a one byte overflow and as per upstream it should be non-exploitable in most condtions.

Red Hat mitigation

Only configurations which use mod_auth_digest are affected by this flaw. Also as per upstream this flaw is not exploitable in most conditions, so there should really be no impact of this flaw.

Metrics

54.81% 0.54808

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.54808

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (57 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	54.81% (0.54808)	98.99th	v5 (v2026.06.15)
Sep 19, 2026	54.81% (0.54808)	98.97th	v5 (v2026.06.15)
Jun 15, 2026	53.19% (0.53191)	98.84th	v5 (v2026.06.15)
Jun 7, 2026	6.31% (0.06315)	91.14th	v4 (v2025.03.14)
Mar 26, 2026	10.70% (0.10695)	93.28th	v4 (v2025.03.14)
Mar 10, 2026	9.00% (0.09000)	92.48th	v4 (v2025.03.14)
Feb 21, 2026	10.29% (0.10294)	93.03th	v4 (v2025.03.14)
Jan 7, 2026	13.39% (0.13393)	93.95th	v4 (v2025.03.14)
Dec 28, 2025	15.71% (0.15705)	94.49th	v4 (v2025.03.14)
Dec 27, 2025	12.32% (0.12318)	93.68th	v4 (v2025.03.14)
Nov 21, 2025	14.97% (0.14970)	94.28th	v4 (v2025.03.14)
Nov 18, 2025	9.71% (0.09705)	92.12th	v4 (v2025.03.14)
Oct 28, 2025	14.97% (0.14970)	94.25th	v4 (v2025.03.14)
Oct 27, 2025	11.71% (0.11715)	93.41th	v4 (v2025.03.14)
Oct 5, 2025	14.97% (0.14970)	94.31th	v4 (v2025.03.14)
Oct 1, 2025	12.75% (0.12746)	93.78th	v4 (v2025.03.14)
Sep 25, 2025	9.90% (0.09904)	92.74th	v4 (v2025.03.14)
Aug 19, 2025	11.71% (0.11715)	93.41th	v4 (v2025.03.14)
Aug 14, 2025	9.07% (0.09070)	92.29th	v4 (v2025.03.14)
Aug 12, 2025	11.71% (0.11715)	93.40th	v4 (v2025.03.14)
Jul 30, 2025	3.74% (0.03741)	87.56th	v4 (v2025.03.14)
Jul 29, 2025	4.94% (0.04940)	89.19th	v4 (v2025.03.14)
May 15, 2025	6.56% (0.06560)	90.62th	v4 (v2025.03.14)
May 11, 2025	5.48% (0.05482)	89.66th	v4 (v2025.03.14)
Mar 30, 2025	6.56% (0.06560)	90.22th	v4 (v2025.03.14)
Mar 29, 2025	45.08% (0.45078)	96.45th	v4 (v2025.03.14)
Mar 24, 2025	6.56% (0.06560)	90.23th	v4 (v2025.03.14)
Mar 23, 2025	22.73% (0.22731)	95.17th	v4 (v2025.03.14)
Mar 17, 2025	6.56% (0.06560)	90.45th	v4 (v2025.03.14)
Dec 17, 2024	1.47% (0.01468)	86.45th	v3 (v2023.03.01)
Dec 12, 2024	0.26% (0.00261)	66.38th	v3 (v2023.03.01)
May 16, 2024	0.18% (0.00184)	55.38th	v3 (v2023.03.01)
Feb 24, 2024	0.22% (0.00220)	59.12th	v3 (v2023.03.01)
Jan 15, 2024	0.20% (0.00202)	58.10th	v3 (v2023.03.01)
Nov 8, 2023	0.20% (0.00196)	57.25th	v3 (v2023.03.01)
Sep 2, 2023	0.63% (0.00632)	76.42th	v3 (v2023.03.01)
Jul 8, 2023	0.90% (0.00895)	80.47th	v3 (v2023.03.01)
May 26, 2023	0.53% (0.00528)	73.67th	v3 (v2023.03.01)
May 8, 2023	0.37% (0.00372)	68.54th	v3 (v2023.03.01)
Mar 7, 2023	0.63% (0.00632)	75.78th	v3 (v2023.03.01)
Mar 6, 2023	3.03% (0.03032)	83.64th	v2 (v2022.01.01)
Apr 1, 2022	3.03% (0.03032)	81.96th	v2 (v2022.01.01)
Feb 4, 2022	24.93% (0.24927)	95.37th	v2 (v2022.01.01)
Feb 3, 2022	27.08% (0.27084)	95.71th	v1
Jan 6, 2022	27.08% (0.27084)	95.66th	v1
Oct 21, 2021	7.65% (0.07646)	91.62th	v1
Sep 25, 2021	7.09% (0.07095)	91.35th	v1
Sep 21, 2021	6.54% (0.06539)	90.26th	v1
Sep 1, 2021	5.98% (0.05976)	89.53th	v1
Jul 17, 2021	5.98% (0.05976)	0.00th	v1
Jul 10, 2021	5.41% (0.05407)	0.00th	v1
Jul 3, 2021	4.25% (0.04249)	0.00th	v1
Jun 24, 2021	3.66% (0.03661)	0.00th	v1
Jun 19, 2021	14.56% (0.14565)	0.00th	v1
Jun 17, 2021	3.66% (0.03661)	0.00th	v1
Jun 11, 2021	1.25% (0.01247)	0.00th	v1
Jun 10, 2021	0.62% (0.00624)	0.00th	v1

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-787

Out-of-bounds Write

References (17)

http://httpd.apache.org/security/vulnerabilities_24.html
x_refsource_MISCVendor Advisory
http://www.openwall.com/lists/oss-security/2021/06/10/5
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2020-35452
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1966724
Issue Tracking
https://httpd.apache.org/security/vulnerabilities_24.html
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rccb1b8225583a48c6360edc7a93cc97ae8b0215791e455dc607e7602%40%3Cannounce.httpd.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
x_refsource_MISCMailing ListRelease NotesVendor Advisory
https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
vendor-advisoryx_refsource_FEDORA
https://nvd.nist.gov/vuln/detail/CVE-2020-35452
https://security.gentoo.org/glsa/202107-38
vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://security.netapp.com/advisory/ntap-20210702-0001/
x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2020-35452
https://www.debian.org/security/2021/dsa-4937
vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
http://httpd.apache.org/security/vulnerabilities_24.html		x_refsource_MISCVendor Advisory
http://www.openwall.com/lists/oss-security/2021/06/10/5		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2020-35452		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1966724		Issue Tracking
https://httpd.apache.org/security/vulnerabilities_24.html
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rccb1b8225583a48c6360edc7a93cc97ae8b0215791e455dc607e7602%40%3Cannounce.httpd.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E		x_refsource_MISCMailing ListRelease NotesVendor Advisory
https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/		vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/		vendor-advisoryx_refsource_FEDORA
https://nvd.nist.gov/vuln/detail/CVE-2020-35452
https://security.gentoo.org/glsa/202107-38		vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://security.netapp.com/advisory/ntap-20210702-0001/		x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2020-35452
https://www.debian.org/security/2021/dsa-4937		vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html		x_refsource_MISCThird Party Advisory