OpenBSD httpd NULL Dereference Can Disrupt Service

In OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020, httpd(8) is vulnerable to a NULL dereference when handling a malformed fastcgi request.

The affected branches are:

• OpenBSD 7.4 before errata 006.
• OpenBSD 7.3 before errata 020.

The corresponding errata are the fixed boundaries supported by the OpenBSD patch sources. The available evidence does not establish the status of other OpenBSD branches.

The weakness is classified as CWE-476 and occurs when httpd(8) processes attacker-controlled data in a malformed FastCGI request. The patch shows that the vulnerable path involves client state in server_fcgi.c and connection-closing logic in server_close. It adds clt_fcgi_count, changes error-state handling, and adjusts coordination with server_abort_http(), indicating that the problem involves interaction among HTTP content processing, FastCGI error handling, and client lifetime management. Comments in the patch refer to a use-after-free workaround, but the available evidence does not establish use-after-free as a separate root cause for this vulnerability. The exact malformed request shape and the specific NULL dereference site are not disclosed.

The flaw is reachable over the network through a malformed FastCGI request. The supplied data indicates that exploitation requires no authentication, no user interaction, and has low complexity. The record does not identify a special prerequisite beyond reaching the httpd(8) FastCGI processing path. The record identifies no public exploit and leaves known exploited unset, but those fields do not prove that exploitation has never occurred. No named campaign, victim, or specific IOC is provided by the available evidence.

The primary technical outcome is a NULL dereference in the FastCGI request path, which may cause process failure or reduce service availability. The attack path can begin over the network and does not require access privileges or user interaction according to the supplied data. The supported impact is to service availability; no direct confidentiality or integrity impact is established. The exact scope depends on how httpd(8) behaves after the malformed request in a given deployment, and the source does not describe the precise post-dereference behavior.

The flaw can reduce or interrupt the availability of httpd(8), making web applications or endpoints that depend on the service temporarily unavailable. On a host reachable from an untrusted network, a specially formed request may trigger an unexpected failure during FastCGI processing. If failures recur, the organization may need to restart the service or handle operational disruption, although the evidence does not establish the frequency or scope of repeated failures. No supplied evidence shows that this flaw directly discloses or modifies data.

1. For OpenBSD 7.4, apply errata 006; for OpenBSD 7.3, apply errata 020.
2. Verify the patch signature with the corresponding base key before applying it, following OpenBSD's patch-verification process.
3. Apply the patch to the source tree, then rebuild and install httpd(8) from /usr/src/usr.sbin/httpd using make obj, make, and make install.
4. Confirm that the running httpd(8) process uses the rebuilt binary with the errata applied. The available sources do not provide a separate workaround beyond applying the patch and rebuilding the affected component.
5. If patching cannot be completed immediately, reduce the ability of untrusted networks to send FastCGI requests where that is compatible with the deployment architecture. This is a precautionary exposure-reduction measure, not an OpenBSD-confirmed workaround.

1. Inventory OpenBSD systems running httpd(8) and record each system's release and errata state.
2. Identify deployments that receive or forward FastCGI traffic so that review can be prioritized, without treating this configuration alone as proof of exposure or safety.
3. For source-built systems, inspect source-tree or build records for the changes involving clt_fcgi_count, server_close, and server_fcgi.
4. Review httpd(8) telemetry for malformed or abnormal FastCGI requests followed by a crash, restart, or service interruption. This is precautionary because the available sources do not define a vulnerability-specific log event or IOC.
5. Do not treat the absence of log evidence or a crash as proof of safety; confirm the release and errata state directly.