CVE-2021-36160

Published: Sep 16, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).

Affected (20)

Products: Apache: Http Server · Fedoraproject: Fedora · Debian: Debian Linux · +3 more

Show all products

Apache: Http Server · Fedoraproject: Fedora · Debian: Debian Linux · Netapp: Cloud Backup, Clustered Data Ontap, Storagegrid · Oracle: Communications Cloud Native Core Network Function Cloud Native Environment, Enterprise Manager Base Platform, Http Server, Instantis Enterprisetrack, Peoplesoft Enterprise Peopletools, Zfs Storage Appliance Kit · Broadcom: Brocade Fabric Operating System Firmware

1 product

1 product

1 product

3 products

6 products

Communications Cloud Native Core Network Function Cloud Native Environment

Enterprise Manager Base Platform

Http Server

Instantis Enterprisetrack

Peoplesoft Enterprise Peopletools

Zfs Storage Appliance Kit

Broadcom

1 product

Brocade Fabric Operating System Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	From 2.4.30 to 2.4.49

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 34
Fedoraproject Fedora	Version 35

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0
Debian Debian Linux	Version 9.0

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Netapp Cloud Backup	All versions
Netapp Clustered Data Ontap	All versions
Netapp Storagegrid	All versions

Configuration E

10 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Cloud Native Core Network Function Cloud Native Environment	Version 1.10.0
Oracle Enterprise Manager Base Platform	Version 13.4.0.0
Oracle Enterprise Manager Base Platform	Version 13.5.0.0
Oracle Http Server	Version 12.2.1.3.0
Oracle Http Server	Version 12.2.1.4.0
Oracle Instantis Enterprisetrack	Version 17.1
Oracle Instantis Enterprisetrack	Version 17.2
Oracle Instantis Enterprisetrack	Version 17.3
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Zfs Storage Appliance Kit	Version 8.8

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Broadcom Brocade Fabric Operating System Firmware	All versions

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (48)

http://httpd.apache.org/security/vulnerabilities_24.html

Source: security@apache.org

Release NotesVendor Advisory

https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c%40%3Cbugs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb%40%3Cbugs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3%40%3Cbugs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781%40%3Cbugs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a%40%3Cbugs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a%40%3Cbugs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/

Source: security@apache.org

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/

Source: security@apache.org

Third Party Advisory

https://security.gentoo.org/glsa/202208-20

Source: security@apache.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20211008-0004/

Source: security@apache.org

Third Party Advisory

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ

Source: security@apache.org

Third Party Advisory

https://www.debian.org/security/2021/dsa-4982

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: security@apache.org

PatchThird Party Advisory

http://httpd.apache.org/security/vulnerabilities_24.html