CVE-2021-41973
Apache MINA HTTP listener DOS
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
6.5
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
- Record
CVE-2021-41973- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-835
- Updated
- 2026-11-02
CVE List No score
Apache MINA HTTP listener DOS
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
- Record
CVE-2021-41973- Weakness
- CWE-835
- Updated
- 2026-11-02
EUVDEUVD-2021-2307 No score
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
- Record
EUVD-2021-2307- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6mcm-j9cj-3vc3
6.5
Infinite loop in Apache MINA
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
- Record
GHSA-6mcm-j9cj-3vc3- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSV
6.5
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
- Record
CVE-2021-41973- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-41973
6.5
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
- Record
DEBIAN-CVE-2021-41973- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-6mcm-j9cj-3vc3
6.5
Infinite loop in Apache MINA
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
- Record
GHSA-6mcm-j9cj-3vc3- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVOESA-2021-1435
6.5
apache-mina security update
Apache MINA is a network application framework which helps users develop high performance and high scalability network applications easily. It provides an abstract event-driven asynchronous API over various transports such as TCP/IP and UDP/IP via Java NIO.
Security Fix(es):
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.(CVE-2021-41973)
- Record
OESA-2021-1435- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-41973
6.5
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
- Record
UBUNTU-CVE-2021-41973- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
- apache mina
- apache software foundation mina
- oracle banking payments
- oracle banking trade finance process management
- oracle banking treasury management
- oracle communications cloud native core console
- oracle customer management and segmentation foundation
- oracle flexcube universal banking
- oracle fusion middleware common libraries and tools
- oracle oss support tools
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.mina:mina-coreMaven |
2.1.0 up to 2.1.5 | 2.1.5 |
org.apache.mina:mina-coreMaven |
before 2.0.22 | 2.0.22 |
mina2Debian:12 |
before 2.1.5-1 | 2.1.5-1 |
mina2Debian:13 |
before 2.1.5-1 | 2.1.5-1 |
mina2Debian:14 |
before 2.1.5-1 | 2.1.5-1 |
org.apache.mina:mina-coreMaven |
2.1.0 up to 2.1.5, plus listed versions 2.1.12.1.22.1.32.1.4 |
2.1.5 |
org.apache.mina:mina-coreMaven |
before 2.0.22, plus listed versions 1.0.01.0.11.0.101.0.21.0.3 Show 43 moreShow less1.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.1.51.1.61.1.72.0.02.0.0-M12.0.0-M22.0.0-M32.0.0-M42.0.0-M52.0.0-M62.0.0-RC12.0.12.0.102.0.112.0.122.0.132.0.142.0.152.0.162.0.172.0.182.0.192.0.22.0.202.0.212.0.32.0.42.0.52.0.62.0.72.0.82.0.9 |
2.0.22 |
apache-minaopenEuler:20.03-LTS-SP1 |
before 2.0.21-2.oe1 | 2.0.21-2.oe1 |
apache-minaopenEuler:20.03-LTS-SP2 |
before 2.0.21-2.oe1 | 2.0.21-2.oe1 |
minaUbuntu:16.04:LTS |
All versions, plus listed versions 1.1.7.dfsg-11 |
None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mina2Ubuntu:16.04:LTS |
All versions, plus listed versions 2.0.7+dfsg-22.0.9-12.0.9-2 |
None known |
minaUbuntu:18.04:LTS |
All versions, plus listed versions 1.1.7.dfsg-111.1.7.dfsg-12 |
None known |
mina2Ubuntu:18.04:LTS |
All versions, plus listed versions 2.0.16-2 |
None known |
minaUbuntu:20.04:LTS |
All versions, plus listed versions 1.1.7.dfsg-13 |
None known |
mina2Ubuntu:20.04:LTS |
All versions, plus listed versions 2.0.19-2 |
None known |
minaUbuntu:22.04:LTS |
All versions, plus listed versions 1.1.7.dfsg-13 |
None known |
minaUbuntu:24.04:LTS |
All versions, plus listed versions 1.1.7.dfsg-131.1.7.dfsg-13ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-41973 is a medium vulnerability (CVSS 6.5) in Apache Mina, published November 1, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.63%, the 91st percentile. Fixed in org.apache.mina:mina-core 2.1.5.
References
lists.apache.org/thread.html/r0b907da9340d5ff4e6c1a4798ef4e79700a668657f27cca8a39e9250%40%3Cdev.mina.apache.org%3E
openwall.com/lists/oss-security/2021/11/01/2
openwall.com/lists/oss-security/2021/11/01/8
oracle.com/security-alerts/cpuapr2022.html
nvd.nist.gov/vuln/detail/CVE-2021-41973
github.com/advisories/GHSA-6mcm-j9cj-3vc3