{"id":"CVE-2021-33193","aliases":["ALPINE-CVE-2021-33193","ALSA-2022:1915","AZL-6483","BELL-CVE-2021-33193","BIT-apache-2021-33193","CLSA-2022-1654106434","CLSA-2022-1654106630","DEBIAN-CVE-2021-33193","DLA-3351-1","EUVD-2021-19907","GHSA-p9fg-6rr5-38xc","MGASA-2021-0439","RHSA-2022:1915","RHSA-2022:6753","RHSA-2022:7143","RLSA-2022:1915","SUSE-SU-2021:2918-1","SUSE-SU-2021:2954-1","SUSE-SU-2021:3335-1","UBUNTU-CVE-2021-33193","USN-5090-1","openSUSE-SU-2021:1234-1","openSUSE-SU-2021:2954-1"],"status":"published","title":"Request splitting via HTTP/2 method injection and mod_proxy","description":"A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.46179,"percentile":0.98831,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-08-16T00:00:00Z","modified":"2026-10-29T11:01:15Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"apache2","fixed_in":["2.4.49-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"apache2","fixed_in":["2.4.49-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"apache2","fixed_in":["2.4.49-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"apache2","fixed_in":["2.4.49-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"apache2","fixed_in":["2.4.49-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"apache2","fixed_in":["2.4.49-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"apache2","fixed_in":["2.4.49-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"apache2","fixed_in":["2.4.49-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"apache2","fixed_in":["2.4.49-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"apache2","fixed_in":["2.4.49-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"apache2","fixed_in":["2.4.49-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"apache2","fixed_in":["2.4.49-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"apache2","fixed_in":["2.4.49-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"apache2","fixed_in":["2.4.49-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"httpd","fixed_in":["2.4.52-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"apache","fixed_in":["2.4.49"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"apache2","fixed_in":["2.4.48-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache2","fixed_in":["2.4.48-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache2","fixed_in":["2.4.48-4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"apache2","fixed_in":["2.4.23-29.77.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"apache2","fixed_in":["2.4.23-29.77.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"apache2","fixed_in":["2.4.23-29.77.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"apache2","fixed_in":["2.4.43-3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"apache2","fixed_in":["2.4.43-3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"apache2","fixed_in":["2.4.43-3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"apache2","fixed_in":["2.4.43-3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"apache2","fixed_in":["2.4.43-3.25.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"apache2","fixed_in":["2.4.29-1ubuntu4.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"apache2","fixed_in":["2.4.41-4ubuntu3.5"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"apache2","fixed_in":["2.4.43-lp152.2.18.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"apache2","fixed_in":["2.4.43-3.25.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.49-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.49-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.49-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.49-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.49-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.49-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.49-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.49-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.49-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.49-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.49-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.49-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.49-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.49-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-47.module_el8.6.0+2935+fb177b09.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-47.module_el8.6.0+2935+fb177b09.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-47.module_el8.6.0+2935+fb177b09.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-47.module_el8.6.0+2935+fb177b09.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-47.module_el8.6.0+2935+fb177b09.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-5.module_el8.6.0+2872+fe0ff7aa"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-47.module_el8.6.0+2935+fb177b09.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-47.module_el8.6.0+2935+fb177b09.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-47.module_el8.6.0+2935+fb177b09.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-47.module_el8.6.0+2935+fb177b09.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:2","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.52-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"apache","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.17"},{"fixed":"2.4.49"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-39.module_el8.4.0+2047+54659116.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-39.module_el8.4.0+2047+54659116.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-39.module_el8.4.0+2047+54659116.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-39.module_el8.4.0+2047+54659116.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-39.module_el8.4.0+2047+54659116.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-3.module_el8.4.0+2047+54659116"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-39.module_el8.4.0+2047+54659116.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-8.module_el8.4.0+2047+54659116"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-39.module_el8.4.0+2047+54659116.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-39.module_el8.4.0+2047+54659116.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-39.module_el8.4.0+2047+54659116.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-43.module_el8.5.0+2046+6f259f31.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-43.module_el8.5.0+2046+6f259f31.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-43.module_el8.5.0+2046+6f259f31.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-43.module_el8.5.0+2046+6f259f31.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-43.module_el8.5.0+2046+6f259f31.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-3.module_el8.5.0+2046+6f259f31"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-43.module_el8.5.0+2046+6f259f31.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-8.module_el8.5.0+2046+6f259f31"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-43.module_el8.5.0+2046+6f259f31.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.37-43.module_el8.5.0+2046+6f259f31.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-43.module_el8.5.0+2046+6f259f31.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-4"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-3+deb10u9"}]}],"versions":["2.4.38-3","2.4.38-3+deb10u1","2.4.38-3+deb10u2","2.4.38-3+deb10u3","2.4.38-3+deb10u4","2.4.38-3+deb10u5","2.4.38-3+deb10u6","2.4.38-3+deb10u7","2.4.38-3+deb10u8"],"bundled":6},{"source":"osv","ecosystem":"Mageia:8","package":"apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.49-1.mga8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-47.module+el8.6.0+14529+083145da.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-47.module+el8.6.0+14529+083145da.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-47.module+el8.6.0+14529+083145da.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-47.module+el8.6.0+14529+083145da.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-47.module+el8.6.0+14529+083145da.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-47.module+el8.6.0+14529+083145da.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-47.module+el8.6.0+14529+083145da.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-47.module+el8.6.0+14529+083145da.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-5.module+el8.6.0+13996+01710940"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-5.module+el8.6.0+13996+01710940"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_http2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-5.module+el8.6.0+13996+01710940"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-47.module+el8.6.0+14529+083145da.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-47.module+el8.6.0+14529+083145da.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-8.module+el8.3.0+6814+67d1e611"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_md-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-8.module+el8.3.0+6814+67d1e611"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_md-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-8.module+el8.3.0+6814+67d1e611"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-47.module+el8.6.0+14529+083145da.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-47.module+el8.6.0+14529+083145da.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-47.module+el8.6.0+14529+083145da.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-47.module+el8.6.0+14529+083145da.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-47.module+el8.6.0+14529+083145da.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-47.module+el8.6.0+14529+083145da.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-23.el7.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-23.el7.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-23.el7.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-23.el7.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-23.el7.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-23.el7.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.34-23.el7.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-23.el7.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.34-23.el7.5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-28.el7jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.51-28.el8jbcs"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-47.module+el8.6.0+823+f143cee1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-5.module+el8.6.0+823+f143cee1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-8.module+el8.5.0+695+1fa8055e"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.8-8.module+el8.4.0+553+7a69454b"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.77.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.77.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.77.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.43-3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.43-3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.43-3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.43-3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.43-3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.33-3.55.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.33-3.55.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.33-3.55.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.33-3.55.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.33-3.55.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.33-3.55.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.33-3.55.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.33-3.55.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.33-3.55.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.33-3.55.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.29-1ubuntu4.17"}]}],"versions":["2.4.27-2ubuntu3","2.4.29-1ubuntu1","2.4.29-1ubuntu2","2.4.29-1ubuntu3","2.4.29-1ubuntu4","2.4.29-1ubuntu4.1","2.4.29-1ubuntu4.2","2.4.29-1ubuntu4.3","2.4.29-1ubuntu4.4","2.4.29-1ubuntu4.5","2.4.29-1ubuntu4.6","2.4.29-1ubuntu4.7","2.4.29-1ubuntu4.8","2.4.29-1ubuntu4.10","2.4.29-1ubuntu4.11","2.4.29-1ubuntu4.12","2.4.29-1ubuntu4.13","2.4.29-1ubuntu4.14","2.4.29-1ubuntu4.16"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.5"}]}],"versions":["2.4.41-1ubuntu1","2.4.41-4ubuntu1","2.4.41-4ubuntu2","2.4.41-4ubuntu3","2.4.41-4ubuntu3.1","2.4.41-4ubuntu3.3","2.4.41-4ubuntu3.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.29-1ubuntu4.17"}]}],"versions":["2.4.27-2ubuntu3","2.4.29-1ubuntu1","2.4.29-1ubuntu2","2.4.29-1ubuntu3","2.4.29-1ubuntu4","2.4.29-1ubuntu4.1","2.4.29-1ubuntu4.2","2.4.29-1ubuntu4.3","2.4.29-1ubuntu4.4","2.4.29-1ubuntu4.5","2.4.29-1ubuntu4.6","2.4.29-1ubuntu4.7","2.4.29-1ubuntu4.8","2.4.29-1ubuntu4.10","2.4.29-1ubuntu4.11","2.4.29-1ubuntu4.12","2.4.29-1ubuntu4.13","2.4.29-1ubuntu4.14","2.4.29-1ubuntu4.16"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.5"}]}],"versions":["2.4.41-1ubuntu1","2.4.41-4ubuntu1","2.4.41-4ubuntu2","2.4.41-4ubuntu3","2.4.41-4ubuntu3.1","2.4.41-4ubuntu3.3","2.4.41-4ubuntu3.4"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.43-lp152.2.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.43-3.25.1"}]}]}],"products":[{"vendor":"apache","product":"http_server"},{"vendor":"apache software foundation","product":"apache http server"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"oracle","product":"secure_backup"},{"vendor":"oracle","product":"zfs_storage_appliance_kit"},{"vendor":"tenable","product":"tenable.sc"}],"references":[{"url":"https://portswigger.net/research/http2","tags":["x_transferred","Exploit","Third Party Advisory","advisory","evidence","article","report"]},{"url":"https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch","tags":["x_transferred","Patch","fix"]},{"url":"https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_transferred","Patch","fix"]},{"url":"https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_transferred","Patch","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20210917-0004/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.tenable.com/security/tns-2021-17","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://security.gentoo.org/glsa/202208-20","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/03/msg00002.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33193","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E"},{"url":"https://security.netapp.com/advisory/ntap-20210917-0004"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T"},{"url":"https://github.com/advisories/GHSA-p9fg-6rr5-38xc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-33193","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1915","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/1966724","tags":["report"]},{"url":"https://bugzilla.redhat.com/1966728","tags":["report"]},{"url":"https://bugzilla.redhat.com/1984828","tags":["report"]},{"url":"https://bugzilla.redhat.com/2001046","tags":["report"]},{"url":"https://bugzilla.redhat.com/2005124","tags":["report"]},{"url":"https://bugzilla.redhat.com/2034672","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-1915.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-35452","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-33193","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-36160","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-44224","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-33193","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1654106434.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2022-1654106630.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-33193","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0439.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29466","tags":["report"]},{"url":"https://downloads.apache.org/httpd/Announcement2.4.html","tags":["web"]},{"url":"https://downloads.apache.org/httpd/CHANGES_2.4.49","tags":["web"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["web","article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1966724","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1966728","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1984828","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2005124","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034672","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1915.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-35452","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-35452","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35452","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33193","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33193","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-36160","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-36160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36160","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44224","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44224","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44224","tags":["advisory"]},{"url":"http://httpd.apache.org/security/vulnerabilities_24.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6753","tags":["advisory"]},{"url":"https://access.redhat.com/articles/6975397","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2005119","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2005128","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064320","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064322","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2094997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095006","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095020","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6753.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-34798","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-34798","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34798","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-39275","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39275","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39275","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22719","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22719","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22719","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-22719","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22721","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22721","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22721","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-22721","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23943","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23943","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23943","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-23943","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-26377","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-26377","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26377","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-26377","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28614","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28614","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28614","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-28614","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28615","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28615","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-28615","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29404","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29404","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29404","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-29404","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30522","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30522","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30522","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-30522","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30556","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30556","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30556","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-30556","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-31813","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-31813","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31813","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-31813","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:7143","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.51/html-single/red_hat_jboss_core_services_apache_http_server_2.4.51_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2010934","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7143.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41524","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41524","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41524","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:1915","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212918-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189387","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33193","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212954-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213335-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1190666","tags":["report"]},{"url":"https://bugzilla.suse.com/1190669","tags":["report"]},{"url":"https://bugzilla.suse.com/1190702","tags":["report"]},{"url":"https://bugzilla.suse.com/1190703","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40438","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-33193","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5090-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-34798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-36160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-39275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-40438","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZXIW57JQ5R7GZCIYAX46QTL35T45Y4MW/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ML464OXXVITHCRNCGTP3DMIAYMJEHJEO/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-33193","title":"Request splitting via HTTP/2 method injection and mod_proxy","description":"A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.","status":"published","published":"2021-08-16T00:00:00Z","modified":"2024-08-03T23:42:20.253Z","updated_at":"2026-11-02T14:33:10.204494Z"}],"euvd":[{"id":"EUVD-2021-19907","description":"A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.","status":"published","published":"2021-08-16T00:00:00Z","modified":"2024-08-03T23:42:20Z","updated_at":"2026-11-03T03:24:34.73748Z"}],"ghsa":[{"id":"GHSA-p9fg-6rr5-38xc","title":"A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which...","description":"A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.","status":"published","published":"2022-05-24T19:11:19Z","modified":"2025-05-01T18:32:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:02:05.821687Z"}],"nvd":[{"id":"CVE-2021-33193","description":"A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.","status":"published","published":"2021-08-16T08:15:11.48Z","modified":"2026-06-17T03:54:19.957Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:56.943671Z"}],"osv":[{"id":"ALPINE-CVE-2021-33193","description":"A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.","status":"published","published":"2021-08-16T08:15:11.48Z","modified":"2026-10-23T17:17:56.190043214Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"AZL-6483","title":"CVE-2021-33193 affecting package httpd for versions less than 2.4.52-1","description":"A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.","status":"published","published":"2021-08-16T08:15:11Z","modified":"2026-04-21T04:32:34.171907Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"BELL-CVE-2021-33193","title":"CVE-2021-33193 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:46.845695Z","modified":"2026-01-26T09:47:35.853302Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-33193","description":"A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.","status":"published","published":"2021-08-16T08:15:11.48Z","modified":"2026-10-20T10:54:43.302745413Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"DEBIAN-CVE-2021-33193","description":"A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.","status":"published","published":"2021-08-16T08:15:11.48Z","modified":"2026-10-23T18:03:59.549648848Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"RHSA-2022:1915","title":"Red Hat Security Advisory: httpd:2.4 security and bug fix update","status":"published","published":"2024-09-13T20:34:00Z","modified":"2026-10-09T10:04:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:6753","title":"Red Hat Security Advisory: httpd24-httpd security and bug fix update","status":"published","published":"2024-09-13T23:20:13Z","modified":"2026-10-09T10:04:48Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:7143","title":"Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 security update","status":"published","published":"2024-09-13T20:33:46Z","modified":"2026-10-09T10:05:13Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2022:1915","title":"Moderate: httpd:2.4 security and bug fix update","description":"The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.\n\nSecurity Fix(es):\n\n* httpd: Request splitting via HTTP/2 method injection and mod_proxy (CVE-2021-33193)\n\n* httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path (CVE-2021-36160)\n\n* httpd: possible NULL dereference or SSRF in forward proxy configurations (CVE-2021-44224)\n\n* httpd: Single zero byte stack overflow in mod_auth_digest (CVE-2020-35452)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.","status":"published","published":"2022-05-10T08:07:40Z","modified":"2026-02-04T09:45:07.16952Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-33193","description":"A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.","status":"published","published":"2021-08-16T08:15:00Z","modified":"2026-04-22T12:53:40.468542Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"ALSA-2022:1915","title":"Moderate: httpd:2.4 security and bug fix update","description":"The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.\n\nSecurity Fix(es):\n\n* httpd: Request splitting via HTTP/2 method injection and mod_proxy (CVE-2021-33193)\n\n* httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path (CVE-2021-36160)\n\n* httpd: possible NULL dereference or SSRF in forward proxy configurations (CVE-2021-44224)\n\n* httpd: Single zero byte stack overflow in mod_auth_digest (CVE-2020-35452)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-05-10T08:07:40Z","modified":"2026-10-29T11:01:15.87935591Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BIT-apache-2021-33193","title":"Request splitting via HTTP/2 method injection and mod_proxy","description":"A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.","status":"published","published":"2024-03-06T10:55:40.87Z","modified":"2026-09-08T08:45:06.51480288Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"CLSA-2022-1654106434","title":"Fixed CVEs in httpd-39.module_el8.4.0+2047+54659116.1.tuxcare.els5: CVE-2020-35452, CVE-2021-33193","description":"\n- CVE-2020-35452: mod_auth_digest: fix a single zero byte stack overflow (#1968278)\n- CVE-2021-33193: fix request splitting via HTTP/2 method injection and mod_proxy (#1972491)","status":"published","published":"2022-06-01T18:00:34Z","modified":"2026-06-01T00:33:10.858689405Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1654106630","title":"Fixed CVEs in httpd-43.module_el8.5.0+2046+6f259f31.tuxcare.els4: CVE-2021-33193, CVE-2020-35452","description":"\n- CVE-2020-35452: mod_auth_digest: fix a single zero byte stack overflow (#1968278)\n- CVE-2021-33193: fix request splitting via HTTP/2 method injection and mod_proxy (#1972491)","status":"published","published":"2022-06-01T18:03:50Z","modified":"2026-10-21T10:47:59.702745758Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"DLA-3351-1","title":"apache2 - security update","status":"published","published":"2023-03-03T00:00:00Z","modified":"2026-03-09T01:23:13.027947Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2021-0439","title":"Updated apache packages fix security vulnerability","description":"A crafted method sent through HTTP/2 will bypass validation and be\nforwarded by mod_proxy, which can lead to request splitting or cache\npoisoning. (CVE-2021-33193)\n\nMalformed requests may cause the server to dereference a NULL pointer.\n(CVE-2021-34798)\n\nA carefully crafted request uri-path can cause mod_proxy_uwsgi to read\nabove the allocated memory and crash (DoS). (CVE-2021-36160)\n\nap_escape_quotes() may write beyond the end of a buffer when given\nmalicious input. No included modules pass untrusted data to these\nfunctions, but third-party / external modules may. (CVE-2021-39275)\n\nA crafted request uri-path can cause mod_proxy to forward the request to\nan origin server choosen by the remote user. (CVE-2021-40438)\n","status":"published","published":"2021-09-23T04:49:29Z","modified":"2026-04-16T04:42:42.080620113Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:1234-1","title":"Security update for apache2","description":"This update for apache2 fixes the following issues:\n\n- CVE-2021-33193: Fixed request splitting via HTTP/2 method injection and mod_proxy (bsc#1189387).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-09-07T09:31:00Z","modified":"2026-02-04T03:56:59.019898Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2954-1","title":"Security update for apache2","description":"This update for apache2 fixes the following issues:\n\n- CVE-2021-33193: Fixed request splitting via HTTP/2 method injection and mod_proxy (bsc#1189387).\n","status":"published","published":"2021-09-03T12:43:53Z","modified":"2026-02-04T03:13:29.661665Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"SUSE-SU-2021:2918-1","title":"Security update for apache2","description":"This update for apache2 fixes the following issues:\n\n- CVE-2021-33193: Fixed request splitting via HTTP/2 method injection and mod_proxy (bsc#1189387).\n","status":"published","published":"2021-09-02T08:02:42Z","modified":"2026-02-04T02:32:50.409143Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2954-1","title":"Security update for apache2","description":"This update for apache2 fixes the following issues:\n\n- CVE-2021-33193: Fixed request splitting via HTTP/2 method injection and mod_proxy (bsc#1189387).\n","status":"published","published":"2021-09-03T12:43:52Z","modified":"2026-02-04T03:18:09.479445Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3335-1","title":"Security update for apache2","description":"This update for apache2 fixes the following issues:\n\n- CVE-2021-40438: Fixed a SRF via a crafted request uri-path. (bsc#1190703)\n- CVE-2021-36160: Fixed an out-of-bounds read via a crafted request uri-path. (bsc#1190702)\n- CVE-2021-39275: Fixed an out-of-bounds write in ap_escape_quotes() via malicious input. (bsc#1190666)\n- CVE-2021-34798: Fixed a NULL pointer dereference via malformed requests. (bsc#1190669)\n- CVE-2021-33193: Fixed request splitting via HTTP/2 method injection and mod_proxy. (bsc#1189387)\n","status":"published","published":"2021-10-12T06:19:02Z","modified":"2026-02-04T03:56:31.213024Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"USN-5090-1","title":"apache2 vulnerabilities","description":"James Kettle discovered that the Apache HTTP Server HTTP/2 module\nincorrectly handled certain crafted methods. A remote attacker could\npossibly use this issue to perform request splitting or cache poisoning\nattacks. (CVE-2021-33193)\n\nIt was discovered that the Apache HTTP Server incorrectly handled certain\nmalformed requests. A remote attacker could possibly use this issue to\ncause the server to crash, resulting in a denial of service.\n(CVE-2021-34798)\n\nLi Zhi Xin discovered that the Apache mod_proxy_uwsgi module incorrectly\nhandled certain request uri-paths. A remote attacker could possibly use\nthis issue to cause the server to crash, resulting in a denial of service.\nThis issue only affected Ubuntu 20.04 LTS and Ubuntu 21.04.\n(CVE-2021-36160)\n\nIt was discovered that the Apache HTTP Server incorrectly handled escaping\nquotes. If the server was configured with third-party modules, a remote\nattacker could use this issue to cause the server to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2021-39275)\n\nIt was discovered that the Apache mod_proxy module incorrectly handled\ncertain request uri-paths. A remote attacker could possibly use this issue\nto cause the server to forward requests to arbitrary origin servers.\n(CVE-2021-40438)\n","status":"published","published":"2021-09-27T14:06:45Z","modified":"2026-04-22T10:18:11.742873Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}