CVE-2024-11148: OpenBSD

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

In OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020, httpd(8) is vulnerable to a NULL dereference when handling a malformed fastcgi request.

Affected products

• OpenBSD OpenBSD: before 7.3 (fixed in 7.3); version 7.3 only; version 7.4 only

Published 2024-12-05. Last modified 2026-06-17.