The vulnerability is located in the httpd core, specifically in the ap_get_option() function, which is defined in the http_core.c file. The function takes three arguments: option , str , and len . The option argument specifies the configuration option to retrieve, str is a pointer to a string that will store the value of the option, and len is the length of the str buffer.
"Apache/2.4.18" "Ubuntu"