When mod_session is enabled, a malformed cookie with an empty key/value pair can crash an Apache child process. Specifically, the cookie parser extracts tokens with apr_strtok. If a cookie comes in at position where both key and value are empty, the second call to apr_strtok(NULL, psep, &plast) will pass a NULL first argument into the function's underlying while loop, which dereferences that pointer without a guard. The result is a NULL pointer dereference and a denial of service at the child level, which can impact other threads running in the same process.

Off-by-One in check_nonce

A local stack buffer can be overflowed by one byte during Digest authentication in mod_auth_digest. The vulnerable code path starts when the server decodes a crafted BASE64 nonce field with apr_base64_decode_binary. Under normal conditions this decoder writes 8 bytes into a local array of size 8 (nonce_time.arr). However, when the date format embedded in the nonce is malformed, the number of decoded bytes produced by the function's internal loop increases to 9. That extra byte is written past the end of nonce_time.arr, overwriting one byte on the program stack.

Use-After-Free in cleanup_tables

A use-after-free affecting cleanup_tables is exposed only when running Apache in ONE_PROCESS mode. The apr_rmm_destroy call inside this function attempts to free a memory block known as client_rmm; under certain timing constraints that same block is already released by apr_allocator_destroy. When the cleanup routine later touches the freed client_rmm memory, the server accesses an invalid address, causing a crash.

Heap Out-of-Bounds Write in ap_escape_quotes

ap_escape_quotes mishandles buffer allocation for escaped input. The length calculation used to size the output buffer does not match the logic used to advance the write pointer through that buffer. With specially chosen input, the function can write past the end of the allocated outchr array. This is a heap-based out-of-bounds write. The same issue was concurrently reported by Google's OSS-Fuzz project only days before it surfaced during this research.

Race Condition on Memory Pool Allocator

A separate fault pattern in Apache Core manifested as intermittent, non-reproducible use-after-free crashes. Investigation points to a race condition between apr_allocator_destroy and allocator_alloc. In concurrent scenarios these memory pool routines appear not fully thread safe, and the race can corrupt memory pool bookkeeping nodes. Eventually, the allocator tries to release a block that was already placed on the free list, triggering a use-after-free. The issue resembles a previously reported bug in ProFTPD (CVE-2020-9273). It is also related to findings by Hanno Böck published in 2018.

Integer Overflow in Session_Identity_Decode

A less severe but easily triggered defect exists in the Session_Identity_Decode function, reachable via a WebDAV LOCK request when mod_dav is active. Sending a request with a very large timeout value, such as Second-41000000004100000000, triggers an addition of two 32-bit integers whose result is stored in a 32-bit variable. The sum can wrap around, producing an integer overflow. No direct memory corruption follows from this bug, but it demonstrates how quickly malformed inputs can hit unexpected arithmetic paths in request parsing.

What This Means for Apache Security

Although Apache HTTP has been fuzzed and audited for years, disclosures such as CVE-2021-41773 and CVE-2021-42013 confirm that critical bugs involving path traversal and file disclosure can still arrive. The results above reinforce that socket-level fuzzing remains an effective method to find memory bugs in production server code. The issues are clustered in request parsing and memory pool lifecycle management, which continue to be weak spots across HTTP server implementations.