CVE-2020-35452: Apache HTTP Server

High severity, CVSS 7.3. EPSS: 54.8% chance of exploitation in the next 30 days.

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow

Affected products

• Apache HTTP Server: from 2.4.0, up to and including 2.4.46
• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 34 only; version 35 only
• Oracle Enterprise Manager Ops Center: version 12.4.0.0 only
• Oracle Instantis Enterprisetrack: version 17.1 only; version 17.2 only; version 17.3 only
• Oracle ZFS Storage Appliance Kit: version 8.8 only

Published 2021-06-10. Last modified 2026-06-17.