fr Sign in

Not rated

CVE-2021-26691 In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause…

Description

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

Affected products and versions

Product	Affected versions	Fixed in
Apache HTTP Server 2.4	2.4.0 → 2.4.46	No fix stated

References

httpd.apache.org httpd.apache.org
lists.apache.org lists.apache.org
[httpd-announce] 20210609 CVE-2021-26691: mod_session response handling heap overflow lists.apache.org
[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json lists.apache.org
[oss-security] 20210609 CVE-2021-26691: Apache httpd: mod_session response handling heap overflow www.openwall.com
[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update lists.debian.org
DSA-4937 www.debian.org
GLSA-202107-38 security.gentoo.org
FEDORA-2021-dce7e7738e lists.fedoraproject.org
FEDORA-2021-e3f6dd670d lists.fedoraproject.org
www.oracle.com www.oracle.com
security.netapp.com security.netapp.com
www.oracle.com www.oracle.com

Timeline

Published June 10, 2021
Last modified August 3, 2024

The 139 CVEs of Apache HTTP Server →

CVE-2026-63686 A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all… Not rated CVE-2026-93546 Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write… Not rated CVE-2026-79768 Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when… Not rated CVE-2026-73637 Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows… Not rated

Track this CVE