Every CVE Search/ Get API key

CVE-2021-41973

Apache MINA HTTP listener DOS

6.5 MediumFix available

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

4.63%Up 3.8 points since Nov 2, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.

Record
CVE-2021-41973
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-835
Updated
2026-11-02
CVE List No score

Apache MINA HTTP listener DOS

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.

Record
CVE-2021-41973
Weakness
CWE-835
Updated
2026-11-02
EUVDEUVD-2021-2307 No score

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.

Record
EUVD-2021-2307
Updated
2026-11-03
GitHub AdvisoriesGHSA-6mcm-j9cj-3vc3 6.5

Infinite loop in Apache MINA

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.

Record
GHSA-6mcm-j9cj-3vc3
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
OSV 6.5

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.

Record
CVE-2021-41973
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-41973 6.5

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.

Record
DEBIAN-CVE-2021-41973
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-6mcm-j9cj-3vc3 6.5

Infinite loop in Apache MINA

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.

Record
GHSA-6mcm-j9cj-3vc3
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
OSVOESA-2021-1435 6.5

apache-mina security update

Apache MINA is a network application framework which helps users develop high performance and high scalability network applications easily. It provides an abstract event-driven asynchronous API over various transports such as TCP/IP and UDP/IP via Java NIO.

Security Fix(es):

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.(CVE-2021-41973)

Record
OESA-2021-1435
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-41973 6.5

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.

Record
UBUNTU-CVE-2021-41973
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.mina:mina-core
Maven
2.1.0 up to 2.1.5
2.1.5
org.apache.mina:mina-core
Maven
before 2.0.22
2.0.22
mina2
Debian:12
before 2.1.5-1
2.1.5-1
mina2
Debian:13
before 2.1.5-1
2.1.5-1
mina2
Debian:14
before 2.1.5-1
2.1.5-1
org.apache.mina:mina-core
Maven
2.1.0 up to 2.1.5, plus listed versions
2.1.12.1.22.1.32.1.4
2.1.5
org.apache.mina:mina-core
Maven
before 2.0.22, plus listed versions
1.0.01.0.11.0.101.0.21.0.3
Show 43 moreShow less
1.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.1.51.1.61.1.72.0.02.0.0-M12.0.0-M22.0.0-M32.0.0-M42.0.0-M52.0.0-M62.0.0-RC12.0.12.0.102.0.112.0.122.0.132.0.142.0.152.0.162.0.172.0.182.0.192.0.22.0.202.0.212.0.32.0.42.0.52.0.62.0.72.0.82.0.9
2.0.22
apache-mina
openEuler:20.03-LTS-SP1
before 2.0.21-2.oe1
2.0.21-2.oe1
apache-mina
openEuler:20.03-LTS-SP2
before 2.0.21-2.oe1
2.0.21-2.oe1
mina
Ubuntu:16.04:LTS
All versions, plus listed versions
1.1.7.dfsg-11
None known
Show 7 moreShow less
Affected packages
PackageAffectedFixed
mina2
Ubuntu:16.04:LTS
All versions, plus listed versions
2.0.7+dfsg-22.0.9-12.0.9-2
None known
mina
Ubuntu:18.04:LTS
All versions, plus listed versions
1.1.7.dfsg-111.1.7.dfsg-12
None known
mina2
Ubuntu:18.04:LTS
All versions, plus listed versions
2.0.16-2
None known
mina
Ubuntu:20.04:LTS
All versions, plus listed versions
1.1.7.dfsg-13
None known
mina2
Ubuntu:20.04:LTS
All versions, plus listed versions
2.0.19-2
None known
mina
Ubuntu:22.04:LTS
All versions, plus listed versions
1.1.7.dfsg-13
None known
mina
Ubuntu:24.04:LTS
All versions, plus listed versions
1.1.7.dfsg-131.1.7.dfsg-13ubuntu1
None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-41973 is a medium vulnerability (CVSS 6.5) in Apache Mina, published November 1, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.63%, the 91st percentile. Fixed in org.apache.mina:mina-core 2.1.5.

References

Show 5 moreShow less
MoveEnter Open