Not rated
CVE-2021-33193 A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request…
Description
A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server | Versions not published |
References
- portswigger.net portswigger.net
- github.com github.com
- [httpd-cvs] 20210916 [httpd-site] branch main updated: Revert "Add descriptions for CVE-2021-33193 CVE-2021-36160" lists.apache.org
- [httpd-cvs] 20210916 [httpd-site] branch main updated: Add descriptions for CVE-2021-33193 CVE-2021-36160 lists.apache.org
- FEDORA-2021-5d2d4b6ac5 lists.fedoraproject.org
- FEDORA-2021-f94985afca lists.fedoraproject.org
- 20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021 tools.cisco.com
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
- www.tenable.com www.tenable.com
- www.oracle.com www.oracle.com
- GLSA-202208-20 security.gentoo.org
- [debian-lts-announce] 20230303 [SECURITY] [DLA 3351-1] apache2 security update lists.debian.org
Timeline
- Published
- Last modified
Other CVEs of Apache HTTP Server
The 139 CVEs of Apache HTTP Server →
CVE-2026-63686
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all…
Not rated
CVE-2026-93546
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write…
Not rated
CVE-2026-79768
Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when…
Not rated
CVE-2026-73637
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows…
Not rated