CVE-2017-3169

CRITICAL

Apache HTTP Server - NULL Pointer Dereference

Title source: rule

Description

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.

Exploits (2)

github WORKING POC 1 stars
by vaishakhcv · perlpoc
https://github.com/vaishakhcv/CVE-exploits/tree/master/CVE-2017-3169
github WORKING POC
by winterwolf32 · perlpoc
https://github.com/winterwolf32/CVE_Exploits-/tree/master/CVE-2017-3169

Scores

CVSS v3 9.8
EPSS 0.3270
EPSS Percentile 96.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-476
Status published
Products (36)
apache/http_server 2.2.0
apache/http_server 2.2.2
apache/http_server 2.2.3
apache/http_server 2.2.11
apache/http_server 2.2.12
apache/http_server 2.2.13
apache/http_server 2.2.14
apache/http_server 2.2.15
apache/http_server 2.2.16
apache/http_server 2.2.17
... and 26 more
Published Jun 20, 2017
Tracked Since Feb 18, 2026