Not rated
CVE-2021-30641 Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'
Description
Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server 2.4 | 2.4.39 → 2.4.46 | No fix stated |
References
- httpd.apache.org httpd.apache.org
- lists.apache.org lists.apache.org
- [httpd-announce] 20210609 CVE-2021-30641: Unexpected URL matching with 'MergeSlashes OFF' lists.apache.org
- [httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json lists.apache.org
- [oss-security] 20210609 CVE-2021-30641: Apache httpd: Unexpected URL matching with 'MergeSlashes OFF' www.openwall.com
- [debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update lists.debian.org
- DSA-4937 www.debian.org
- GLSA-202107-38 security.gentoo.org
- FEDORA-2021-dce7e7738e lists.fedoraproject.org
- FEDORA-2021-e3f6dd670d lists.fedoraproject.org
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of Apache HTTP Server
The 139 CVEs of Apache HTTP Server →
CVE-2026-63686
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all…
Not rated
CVE-2026-93546
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write…
Not rated
CVE-2026-79768
Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when…
Not rated
CVE-2026-73637
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows…
Not rated