CVE-2020-13950

mod_proxy_http NULL pointer dereference

Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service

We have discovered 124,661 live websites that are affected by CVE-2020-13950.

Run a Free Instant Scan



Affected Software

Product  Apache
Category Web Servers
Vulnerable Domains124,661 live websites (5.05% of Apache install base)
Vulnerable Versions
  • from 2.4.41 through 2.4.41
  • from 2.4.43 through 2.4.43
  • from 2.4.46 through 2.4.46
Vulnerable Versions Count3 versions ( 2.44% of all versions)



Details

  • Published - Jun 10, 2021
  • Updated - Aug 4, 2024

Credits

  • Reported by Marc Stern (<marc.stern approach.be>)

Website Distribution by Country

Number of websites using CVE-2020-13950
United States39,286 websites


Germany11,330 websites
Poland11,208 websites
Italy7,468 websites
Russia5,280 websites
France4,892 websites
Canada4,457 websites
GB3,181 websites
Singapore2,996 websites
Netherlands2,792 websites

Website Distribution by TLD

Number of websites using CVE-2020-13950
.com42,443 websites
.pl10,358 websites
.it6,895 websites
.de6,061 websites
.org5,991 websites
.net4,960 websites
.ru4,677 websites
.ca2,423 websites
.nl2,382 websites
.cz2,233 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2020-13950

Top websites that are affected by CVE-2020-13950. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****.*********.net GB*,***
*************.com France*,***
*********.net GB*,***
*******.org Germany*,***
******************.org United States*,***
*********.org Germany*,***
************.com United States*,***
******.it Italy*,***
****.***.it Italy*,***
********.jp Japan*,***
See full domain list

FAQ

A total of 124,661 websites have been identified as vulnerable to CVE-2020-13950, based on global website indexing conducted by WebTechSurvey.
The Apache is affected by the CVE-2020-13950 vulnerability.
Apache versions up to and including 2.4.46 are vulnerable to CVE-2020-13950.

References