CVE-2017-3169

CRITICAL

Apache HTTP Server - NULL Pointer Dereference

Title source: rule

Description

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.

Exploits (2)

github WORKING POC 1 stars
by vaishakhcv · perlpoc
https://github.com/vaishakhcv/CVE-exploits/tree/master/CVE-2017-3169
github WORKING POC
by winterwolf32 · perlpoc
https://github.com/winterwolf32/CVE_Exploits-/tree/master/CVE-2017-3169

Scores

CVSS v3 9.8
EPSS 0.3452
EPSS Percentile 96.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-476
Status draft

Affected Products (34)

apache/http_server
apache/http_server
apache/http_server
apache/http_server
apache/http_server
apache/http_server
apache/http_server
apache/http_server
apache/http_server
apache/http_server
apache/http_server
apache/http_server
apache/http_server
apache/http_server
apache/http_server
... and 19 more

Timeline

Published Jun 20, 2017
Tracked Since Feb 18, 2026