CVE-2021-20325

Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red...

9.8 CriticalFix available

Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression compared to the versions shipped in Red Hat Enterprise Linux 8.4. A user who installs or updates to Red Hat Enterprise Linux 8.5.0 would be vulnerable to the mentioned CVEs, even if they were properly fixed in Red Hat Enterprise Linux 8.4. CVE-2021-20325 was assigned to that Red Hat specific security regression and it does not affect the upstream versions of httpd.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.59%Up 0.7 points since Feb 19, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2021-20325
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-119, CWE-787, CWE-918
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-20325
Weakness: CWE-119
Updated: 2026-11-02

EUVDEUVD-2021-7748 No score

Record: EUVD-2021-7748
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4pm7-9gg5-72pv 9.8

Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red...

Record: GHSA-4pm7-9gg5-72pv
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-119, CWE-787
Updated: 2026-11-02

OSVRHSA-2021:4537 9.0

Red Hat Security Advisory: httpd:2.4 security update

Record: RHSA-2021:4537
CVSS 3.1: 9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2021:4537 9.0

Important: httpd:2.4 security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

httpd: Regression of CVE-2021-40438 and CVE-2021-26691 fixes in Rocky Linux 8.5 (CVE-2021-20325)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2021:4537
CVSS 3.1: 9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVALSA-2021:4537 No score

Important: httpd:2.4 security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

httpd: Regression of CVE-2021-40438 and CVE-2021-26691 fixes in AlmaLinux (CVE-2021-20325)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2021:4537
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`httpd` AlmaLinux:8	before 2.4.37-43.module_el8.5.0+2597+c4b14997.alma	2.4.37-43.module_el8.5.0+2597+c4b14997.alma
`httpd-devel` AlmaLinux:8	before 2.4.37-43.module_el8.5.0+2597+c4b14997.alma	2.4.37-43.module_el8.5.0+2597+c4b14997.alma
`httpd-filesystem` AlmaLinux:8	before 2.4.37-43.module_el8.5.0+2597+c4b14997.alma	2.4.37-43.module_el8.5.0+2597+c4b14997.alma
`httpd-manual` AlmaLinux:8	before 2.4.37-43.module_el8.5.0+2597+c4b14997.alma	2.4.37-43.module_el8.5.0+2597+c4b14997.alma
`httpd-tools` AlmaLinux:8	before 2.4.37-43.module_el8.5.0+2597+c4b14997.alma	2.4.37-43.module_el8.5.0+2597+c4b14997.alma
`mod_http2` AlmaLinux:8	before 1.15.7-3.module_el8.5.0+2609+b30d9eec	1.15.7-3.module_el8.5.0+2609+b30d9eec
`mod_ldap` AlmaLinux:8	before 2.4.37-43.module_el8.5.0+2597+c4b14997.alma	2.4.37-43.module_el8.5.0+2597+c4b14997.alma
`mod_md` AlmaLinux:8	before 1:2.0.8-8.module_el8.5.0+2609+b30d9eec	1:2.0.8-8.module_el8.5.0+2609+b30d9eec
`mod_md` AlmaLinux:8	before 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa	1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa
`mod_proxy_html` AlmaLinux:8	before 1:2.4.37-43.module_el8.5.0+2597+c4b14997.alma	1:2.4.37-43.module_el8.5.0+2597+c4b14997.alma

Show 29 moreShow less

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, products	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-20325 is a critical vulnerability (CVSS 9.8) in Red Hat Httpd, published November 9, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.59%, the 75th percentile. Fixed in httpd 2.4.37-43.module_el8.5.0+2597+c4b14997.alma.

References

Show 6 moreShow less

Package	Affected	Fixed
`mod_session` AlmaLinux:8	before 2.4.37-43.module_el8.5.0+2597+c4b14997.alma	2.4.37-43.module_el8.5.0+2597+c4b14997.alma
`mod_ssl` AlmaLinux:8	before 1:2.4.37-43.module_el8.5.0+2597+c4b14997.alma	1:2.4.37-43.module_el8.5.0+2597+c4b14997.alma
`httpd` Red Hat:enterprise_linux:8::appstream	before 0:2.4.37-43.module+el8.5.0+13064+c4b14997	0:2.4.37-43.module+el8.5.0+13064+c4b14997
`httpd-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:2.4.37-43.module+el8.5.0+13064+c4b14997	0:2.4.37-43.module+el8.5.0+13064+c4b14997
`httpd-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:2.4.37-43.module+el8.5.0+13064+c4b14997	0:2.4.37-43.module+el8.5.0+13064+c4b14997
`httpd-devel` Red Hat:enterprise_linux:8::appstream	before 0:2.4.37-43.module+el8.5.0+13064+c4b14997	0:2.4.37-43.module+el8.5.0+13064+c4b14997
`httpd-filesystem` Red Hat:enterprise_linux:8::appstream	before 0:2.4.37-43.module+el8.5.0+13064+c4b14997	0:2.4.37-43.module+el8.5.0+13064+c4b14997
`httpd-manual` Red Hat:enterprise_linux:8::appstream	before 0:2.4.37-43.module+el8.5.0+13064+c4b14997	0:2.4.37-43.module+el8.5.0+13064+c4b14997
`httpd-tools` Red Hat:enterprise_linux:8::appstream	before 0:2.4.37-43.module+el8.5.0+13064+c4b14997	0:2.4.37-43.module+el8.5.0+13064+c4b14997
`httpd-tools-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:2.4.37-43.module+el8.5.0+13064+c4b14997	0:2.4.37-43.module+el8.5.0+13064+c4b14997
`mod_http2` Red Hat:enterprise_linux:8::appstream	before 0:1.15.7-3.module+el8.4.0+8625+d397f3da	0:1.15.7-3.module+el8.4.0+8625+d397f3da
`mod_http2-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:1.15.7-3.module+el8.4.0+8625+d397f3da	0:1.15.7-3.module+el8.4.0+8625+d397f3da
`mod_http2-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:1.15.7-3.module+el8.4.0+8625+d397f3da	0:1.15.7-3.module+el8.4.0+8625+d397f3da
`mod_ldap` Red Hat:enterprise_linux:8::appstream	before 0:2.4.37-43.module+el8.5.0+13064+c4b14997	0:2.4.37-43.module+el8.5.0+13064+c4b14997
`mod_ldap-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:2.4.37-43.module+el8.5.0+13064+c4b14997	0:2.4.37-43.module+el8.5.0+13064+c4b14997
`mod_md` Red Hat:enterprise_linux:8::appstream	before 1:2.0.8-8.module+el8.3.0+6814+67d1e611	1:2.0.8-8.module+el8.3.0+6814+67d1e611
`mod_md-debuginfo` Red Hat:enterprise_linux:8::appstream	before 1:2.0.8-8.module+el8.3.0+6814+67d1e611	1:2.0.8-8.module+el8.3.0+6814+67d1e611
`mod_md-debugsource` Red Hat:enterprise_linux:8::appstream	before 1:2.0.8-8.module+el8.3.0+6814+67d1e611	1:2.0.8-8.module+el8.3.0+6814+67d1e611
`mod_proxy_html` Red Hat:enterprise_linux:8::appstream	before 1:2.4.37-43.module+el8.5.0+13064+c4b14997	1:2.4.37-43.module+el8.5.0+13064+c4b14997
`mod_proxy_html-debuginfo` Red Hat:enterprise_linux:8::appstream	before 1:2.4.37-43.module+el8.5.0+13064+c4b14997	1:2.4.37-43.module+el8.5.0+13064+c4b14997
`mod_session` Red Hat:enterprise_linux:8::appstream	before 0:2.4.37-43.module+el8.5.0+13064+c4b14997	0:2.4.37-43.module+el8.5.0+13064+c4b14997
`mod_session-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:2.4.37-43.module+el8.5.0+13064+c4b14997	0:2.4.37-43.module+el8.5.0+13064+c4b14997
`mod_ssl` Red Hat:enterprise_linux:8::appstream	before 1:2.4.37-43.module+el8.5.0+13064+c4b14997	1:2.4.37-43.module+el8.5.0+13064+c4b14997
`mod_ssl-debuginfo` Red Hat:enterprise_linux:8::appstream	before 1:2.4.37-43.module+el8.5.0+13064+c4b14997	1:2.4.37-43.module+el8.5.0+13064+c4b14997
`httpd` Rocky Linux:8	before 0:2.4.37-43.module+el8.5.0+714+5ec56ee8	0:2.4.37-43.module+el8.5.0+714+5ec56ee8
`mod_http2` Rocky Linux:8	before 0:1.15.7-3.module+el8.4.0+553+7a69454b	0:1.15.7-3.module+el8.4.0+553+7a69454b
`mod_http2` Rocky Linux:8	before 0:1.15.7-3.module+el8.5.0+695+1fa8055e	0:1.15.7-3.module+el8.5.0+695+1fa8055e
`mod_md` Rocky Linux:8	before 1:2.0.8-8.module+el8.5.0+695+1fa8055e	1:2.0.8-8.module+el8.5.0+695+1fa8055e
`mod_md` Rocky Linux:8	before 1:2.0.8-8.module+el8.4.0+553+7a69454b	1:2.0.8-8.module+el8.4.0+553+7a69454b