title: Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier
description: A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
problem types: CWE-476 NULL Pointer Dereference
affected:
{
product: Apache HTTP Server
vendor: Apache Software Foundation
versions:
lessThan: Apache HTTP Server 2.4*, status: affected, version: 2.4.7, versionType: custom
}
metrics:
other: [
content: {'other': 'moderate'}
type: unknown
]