Published: 10/06/2021 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache http server
debian debian linux 9.0
debian debian linux 10.0
fedoraproject fedora 34
fedoraproject fedora 35
oracle instantis enterprisetrack 17.1
oracle instantis enterprisetrack 17.2
oracle instantis enterprisetrack 17.3
oracle enterprise manager ops center 12.4.0.0
oracle zfs storage appliance kit 8.8
oracle secure backup
netapp cloud backup -

Several vulnerabilities have been found in the Apache HTTP server, which could result in denial of service In addition the implementation of the MergeSlashes option could result in unexpected behaviour For the stable distribution (buster), these problems have been fixed in version 2438-3+deb10u5 We recommend that you upgrade your apache2 packa ...

A flaw was found in Apache httpd The mod_proxy_wstunnel module tunnels non-upgraded connections (CVE-2019-17567) A flaw was found in HTTPd In some Apache HTTP Server versions, unprivileged local users can stop HTTPd on Windows The highest threat from this vulnerability is to system availability (CVE-2020-13938) A flaw was found In Apache httpd ...

A heap overflow flaw was found In Apache httpd mod_session The highest threat from this vulnerability is to system availability ...

In Apache HTTP Server versions 240 to 2446, a specially crafted SessionHeader sent by an origin server could cause a heap overflow ...

Critical Infrastructure Sectors: Critical Manufacturing

oss-sec mailing list archives   By Date By Thread </form>    CVE-2021-26691: Apache httpd: mod_session response handling heap overflow   ...

blackbox-scan This tool is a command-line client for the BlackBox API, that can help to integrate Dynamic Application Security Testing (DAST) into a CI/CD pipeline Requirements Python version 362 or above is required to run the tool The use of virtualenv is recommended To install required Python packages, run: pip install -r requirementstxt

CWE-787 http://httpd.apache.org/security/vulnerabilities_24.html https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E http://www.openwall.com/lists/oss-security/2021/06/10/7 https://security.netapp.com/advisory/ntap-20210702-0001/https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html https://www.debian.org/security/2021/dsa-4937 https://security.gentoo.org/glsa/202107-38 https://www.oracle.com/security-alerts/cpuoct2021.html https://www.oracle.com/security-alerts/cpujan2022.html https://lists.apache.org/thread.html/r50cae1b71f1e7421069036b213c26da7d8f47dd59874e3bd956959fe%40%3Cannounce.httpd.apache.org%3E https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/https://nvd.nist.gov https://github.com/hound672/BlackBox-CI-CD-script https://www.debian.org/security/2021/dsa-4937 https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-02

CVE-2021-26691

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Mailing Lists

Github Repositories

References

Vulmon Search

About

Products

Connect