CVEs-PoC/2021/CVE-2021-41524.md

### [CVE-2021-41524](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41524)
![](https://img.shields.io/static/v1?label=Product&message=Apache%20HTTP%20Server&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=2.4.49%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-476%20NULL%20Pointer%20Dereference&color=brightgreen)

### Description

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

### POC

#### Reference
- https://www.oracle.com/security-alerts/cpujan2022.html

#### Github
- https://github.com/20142995/nuclei-templates
- https://github.com/Farrhouq/Inpt-report
- https://github.com/NeoOniX/5ATTACK
- https://github.com/cyb3r-w0lf/nuclei-template-collection
- https://github.com/lekctut/sdb-hw-13-01
- https://github.com/pedr0alencar/vlab-metasploitable2