CVE-2021-26691

MITRE NVD CVE.ORG Print: PDF PDF

Summary

CVECVE-2021-26691
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2021-06-10 07:15:00 UTC
Updated2023-11-07 03:31:00 UTC
DescriptionIn Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

Risk And Classification

Problem Types: CWE-787

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Application Apache Http Server All All All All
Operating System Debian Debian Linux 10.0 All All All
Operating System Debian Debian Linux 9.0 All All All
Operating System Fedoraproject Fedora 34 All All All
Operating System Fedoraproject Fedora 35 All All All
Application Netapp Cloud Backup - All All All
Application Oracle Enterprise Manager Ops Center 12.4.0.0 All All All
Application Oracle Instantis Enterprisetrack 17.1 All All All
Application Oracle Instantis Enterprisetrack 17.2 All All All
Application Oracle Instantis Enterprisetrack 17.3 All All All
Application Oracle Secure Backup All All All All
Application Oracle Zfs Storage Appliance Kit 8.8 All All All

References

ReferenceSourceLinkTags
Pony Mail! MLIST lists.apache.org
Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project CONFIRM httpd.apache.org
Pony Mail! CONFIRM lists.apache.org
[SECURITY] Fedora 35 Update: httpd-2.4.49-1.fc35 - package-announce - Fedora Mailing-Lists FEDORA lists.fedoraproject.org
oss-security - CVE-2021-26691: Apache httpd: mod_session response handling heap overflow MLIST www.openwall.com
[SECURITY] Fedora 34 Update: httpd-2.4.49-1.fc34 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
June 2021 Apache HTTP Server Vulnerabilities in NetApp Products | NetApp Product Security CONFIRM security.netapp.com
Oracle Critical Patch Update Advisory - October 2021 MISC www.oracle.com
Debian -- Security Information -- DSA-4937-1 apache2 DEBIAN www.debian.org
Oracle Critical Patch Update Advisory - January 2022 MISC www.oracle.com
[SECURITY] [DLA 2706-1] apache2 security update MLIST lists.debian.org
Apache: Multiple vulnerabilities (GLSA 202107-38) — Gentoo security GENTOO security.gentoo.org
[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json lists.apache.org
Pony Mail! MLIST lists.apache.org
[SECURITY] Fedora 35 Update: httpd-2.4.49-1.fc35 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
[SECURITY] Fedora 34 Update: httpd-2.4.49-1.fc34 - package-announce - Fedora Mailing-Lists FEDORA lists.fedoraproject.org
[httpd-announce] 20210609 CVE-2021-26691: mod_session response handling heap overflow lists.apache.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Vendor Comments And Credit

Discovery Credit

LEGACY: Discovered internally Christophe Jaillet

Legacy QID Mappings

  • 150398 Apache HTTP Server Multiple Vulnerabilities(CVE-2021-26690,CVE-2021-26691)
  • 159418 Oracle Enterprise Linux Security Update for httpd:2.4 (ELSA-2021-3816)
  • 159594 Oracle Enterprise Linux Security Update for httpd (ELSA-2022-0143)
  • 178699 Debian Security Update for apache2 (DSA 4937-1)
  • 178701 Debian Security Update for apache2 (DLA 2706-1)
  • 179980 Debian Security Update for apache2 (CVE-2021-26691)
  • 198413 Ubuntu Security Notification for Apache HTTP Server vulnerabilities (USN-4994-1)
  • 239671 Red Hat Update for httpd:2.4 (RHSA-2021:3816)
  • 239865 Red Hat Update for red hat jboss core services apache Hypertext Transfer Protocol (HTTP) server 2.4.37 sp10 (RHSA-2021:4614)
  • 239871 Red Hat Update for httpd:2.4 (RHSA-2021:4537)
  • 240007 Red Hat Update for httpd (RHSA-2022:0143)
  • 257148 CentOS Security Update for httpd (CESA-2022:0143)
  • 281910 Fedora Security Update for Hypertext Transfer Protocol Daemon (HTTPd) (FEDORA-2021-dce7e7738e)
  • 352395 Amazon Linux Security Advisory for httpd: ALAS2-2021-1659
  • 352462 Amazon Linux Security Advisory for httpd: ALAS2-2021-1674
  • 352477 Amazon Linux Security Advisory for httpd24: ALAS-2021-1514
  • 377101 Alibaba Cloud Linux Security Update for httpd:2.4 (ALINUX3-SA-2021:0074)
  • 377218 Alibaba Cloud Linux Security Update for httpd (ALINUX2-SA-2022:0004)
  • 378420 IBM Hypertext Transfer Protocol (HTTP) Server Multiple Vulnerabilities (6467651)
  • 500021 Alpine Linux Security Update for apache2
  • 503712 Alpine Linux Security Update for apache2
  • 590870 Mitsubishi Electric MELSOFT iQ AppPortal Multiple Vulnerabilities (ICSA-22-132-02)
  • 670623 EulerOS Security Update for httpd (EulerOS-SA-2021-2381)
  • 670705 EulerOS Security Update for httpd (EulerOS-SA-2021-2463)
  • 670742 EulerOS Security Update for httpd (EulerOS-SA-2021-2500)
  • 670771 EulerOS Security Update for httpd (EulerOS-SA-2021-2529)
  • 670795 EulerOS Security Update for httpd (EulerOS-SA-2021-2553)
  • 670873 EulerOS Security Update for httpd (EulerOS-SA-2021-2381)
  • 671023 EulerOS Security Update for httpd (EulerOS-SA-2021-2586)
  • 690107 Free Berkeley Software Distribution (FreeBSD) Security Update for apache httpd (cce76eca-ca16-11eb-9b84-d4c9ef517024)
  • 710030 Gentoo Linux Apache Multiple vulnerabilities (GLSA 202107-38)
  • 730109 Apache HTTP Server Multiple Vulnerabilities
  • 750660 SUSE Enterprise Linux Security Update for apache2 (SUSE-SU-2021:2004-1)
  • 750662 SUSE Enterprise Linux Security Update for apache2 (SUSE-SU-2021:2006-1)
  • 750719 OpenSUSE Security Update for apache2 (openSUSE-SU-2021:0908-1)
  • 750813 OpenSUSE Security Update for apache2 (openSUSE-SU-2021:2127-1)
  • 87456 IBM HTTP Server Multiple Vulnerabilities(6467651,869064)
  • 900030 CBL-Mariner Linux Security Update for httpd 2.4.46
  • 901227 Common Base Linux Mariner (CBL-Mariner) Security Update for httpd (6477-1)
  • 902995 Common Base Linux Mariner (CBL-Mariner) Security Update for httpd (4371)
  • 940297 AlmaLinux Security Update for httpd:2.4 (ALSA-2021:3816)
  • 960440 Rocky Linux Security Update for httpd:2.4 (RLSA-2021:3816)
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report