Zhen Kong

A NULL pointer dereference exists in the `mod heartmonitor` module when used over a unicast listener. This issue can lead to a Denial of Service (DoS), which is a condition where the server becomes unavailable to legitimate users.

Missing authentication checks in the `mod auth digest` module allow an unauthenticated remote client to trigger a denial of service, specifically forced re-authentication. This occurs when Digest authentication is enabled with the `AuthDigestNcCheck` setting and the attacker sends forged Authorization headers.

Improper validation of the FTP PASV reply address in the `mod proxy ftp` module allows an untrusted FTP server to force the proxy to open a data connection to an arbitrary third-party host. This occurs in forward proxy configurations when the server processes a crafted PASV response.

A stack-based buffer overflow exists in the `mod vhost alias` module. A remote client can trigger a denial of service or potentially execute arbitrary code by sending an HTTP request with a `Host` header exceeding 8192 bytes. This occurs when `VirtualDocumentRoot` uses a hostname format specifier and the `LimitRequestFieldSize` directive is increased above its default value.

A NULL pointer dereference occurs in the `mod xml2enc` module. This allows an untrusted backend server to trigger a denial of service by sending a proxied response with a charset that partially succeeds and then fails during conversion.

A use after free issue exists in the `mod auth digest` module. This occurs when an unauthenticated remote client sends concurrent Digest authentication requests while `AuthDigestNcCheck` is enabled or `AuthDigestNonceLifetime` is set to 0, leading to authentication state corruption. Use after free is a condition where a program continues to use a pointer after it has been freed, which can lead to crashes or unpredictable behavior.

An integer overflow exists in the `mod dav fs` module. An authenticated WebDAV client with write access can trigger this issue by sending PROPPATCH requests that declare an excessive number of XML namespaces. This can lead to the crashing of worker processes and the persistent corruption of a directory's property database.

An uncontrolled resource consumption issue exists due to an allocation leak in the HTTP/2 backlog tracking that occurs when a stream is reset.