CVE-2021-44224

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

Apache HTTP Server.

Security Fix(es):

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).(CVE-2021-44224)

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.(CVE-2021-44790)

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Request splitting via HTTP/2 method injection and mod_proxy (CVE-2021-33193)

• httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path (CVE-2021-36160)

• httpd: possible NULL dereference or SSRF in forward proxy configurations (CVE-2021-44224)

• httpd: Single zero byte stack overflow in mod_auth_digest (CVE-2020-35452)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Request splitting via HTTP/2 method injection and mod_proxy (CVE-2021-33193)

• httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path (CVE-2021-36160)

• httpd: possible NULL dereference or SSRF in forward proxy configurations (CVE-2021-44224)

• httpd: Single zero byte stack overflow in mod_auth_digest (CVE-2020-35452)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

• SECURITY UPDATE: buffer overflow in the mod_lua multipart parser
  • debian/patches/CVE-2021-44970.patch: add test to prevent integer overflow in req_parsebody()
  • CVE-2021-44970
• SECURITY UPDATE: null pointer dereference in reverse proxy module
  • debian/patches/CVE-2021-44224.patch: add tests for return value of ap_proxy_de_socketfy()
  • CVE-2021-44224

• CVE-2021-44224: possible NULL dereference or SSRF in forward proxy configurations
• CVE-2021-39275: out-of-bounds write in ap_escape_quotes() via malicious input
• CVE-2021-36160: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path
• CVE-2021-34798: NULL pointer dereference via malformed requests

• CVE-2021-44224: possible NULL dereference or SSRF in forward proxy configurations
• CVE-2021-39275: out-of-bounds write in ap_escape_quotes() via malicious input
• CVE-2021-36160: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path
• CVE-2021-34798: NULL pointer dereference via malformed requests

Updated apache packages fix security vulnerabilities: A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery) (CVE-2021-44224).

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerability though it might be possible to craft one (CVE-2021-44790).

This update for apache2 fixes the following issues:

Apache2 was updated to the current stable version 2.4.51 (jsc#SLE-22733 jsc#SLE-22849)

It fixes all CVEs and selected bugs represented by patches found between 2.4.23 and 2.4.51.

See https://downloads.apache.org/httpd/CHANGES_2.4 for a complete change log.

Also fixed:

• CVE-2021-44224: Fixed NULL dereference or SSRF in forward proxy configurations (bsc#1193943)
• CVE-2021-44790: Fixed buffer overflow when parsing multipart content in mod_lua (bsc#1193942)

These are all security issues fixed in the apache2-2.4.52-1.1 package on the GA media of openSUSE Tumbleweed.

This update for apache2 fixes the following issues:

• CVE-2021-44224: Fixed NULL dereference or SSRF in forward proxy configurations. (bsc#1193943)
• CVE-2021-44790: Fixed buffer overflow when parsing multipart content in mod_lua. (bsc#1193942)

This update for apache2 fixes the following issues:

Apache2 was updated to the current stable version 2.4.51 (jsc#SLE-22733 jsc#SLE-22849)

It fixes all CVEs and selected bugs represented by patches found between 2.4.23 and 2.4.51.

See https://downloads.apache.org/httpd/CHANGES_2.4 for a complete change log.

Also fixed:

• CVE-2021-44224: Fixed NULL dereference or SSRF in forward proxy configurations (bsc#1193943)
• CVE-2021-44790: Fixed buffer overflow when parsing multipart content in mod_lua (bsc#1193942)

This update for apache2 fixes the following issues:

Apache2 was updated to the current stable version 2.4.51 (jsc#SLE-22733 jsc#SLE-22849)

It fixes all CVEs and selected bugs represented by patches found between 2.4.23 and 2.4.51.

See https://downloads.apache.org/httpd/CHANGES_2.4 for a complete change log.

Also fixed:

• CVE-2021-44224: Fixed NULL dereference or SSRF in forward proxy configurations (bsc#1193943)
• CVE-2021-44790: Fixed buffer overflow when parsing multipart content in mod_lua (bsc#1193942)

This update for apache2 fixes the following issues:

• CVE-2021-44224: Fixed NULL dereference or SSRF in forward proxy configurations. (bsc#1193943)
• CVE-2021-44790: Fixed buffer overflow when parsing multipart content in mod_lua. (bsc#1193942)

This update for apache2 fixes the following issues:

• CVE-2021-44224: Fixed NULL dereference or SSRF in forward proxy configurations (bsc#1193943)
• CVE-2021-44790: Fixed a buffer overflow when parsing multipart content in mod_lua (bsc#1193942)

This update also enables TLS 1.3 support, by building against openssl 1.1 [jsc#SLE-18664]

This update for apache2 fixes the following issues

• CVE-2026-23918: http2: double free and possible RCE on early reset (bsc#1263957).
• CVE-2026-24072: mod_rewrite elevation of privileges via ap_expr (bsc#1263935).
• CVE-2026-28780: heap buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (bsc#1264163).
• CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
• CVE-2026-29168: allocation of resources without limits in mod_md via OCSP response (bsc#1264150).
• CVE-2026-29169: NULL pointer dereference in mod_dav_lock allows server crash via malicious requests (bsc#1263956).
• CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
• CVE-2026-33006: mod_auth_digest timing attack allows bypass of Digest authentication (bsc#1263955).
• CVE-2026-33007: NULL pointer dereference in mod_authn_socache allows unauthenticated remote user to crash a child processes (bsc#1263954).
• CVE-2026-33523: HTTP response splitting forwarding malicious status line (bsc#1263953).
• CVE-2026-33857: off-by-one OOB reads in AJP getter functions (bsc#1263952).
• CVE-2026-34032: heap buffer overread in mod_proxy_ajp due to missing null-termination check (bsc#1263951).
• CVE-2026-34059: heap buffer overread and memory disclosure via ajp_parse_data() (bsc#1263950).
• CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
• CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
• CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
• CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
• CVE-2026-43951: out-of-bound read in merge_response_headers can cause crash (bsc#1267963).
• CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
• CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP send_request (bsc#1267969).
• CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of service (bsc#1267970).
• CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
• CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free (bsc#1267972).
• CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).

Non security issue:

• Update to 2.4.66 (jsc#PED-16334).

It was discovered that the Apache HTTP Server incorrectly handled certain forward proxy requests. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly perform a Server Side Request Forgery attack. (CVE-2021-44224)

It was discovered that the Apache HTTP Server Lua module incorrectly handled memory in the multipart parser. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-44790)

USN-5212-1 fixed several vulnerabilities in Apache. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that the Apache HTTP Server incorrectly handled certain forward proxy requests. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly perform a Server Side Request Forgery attack. (CVE-2021-44224)

It was discovered that the Apache HTTP Server Lua module incorrectly handled memory in the multipart parser. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-44790)