CVE-2021-26691 Apache HTTP Server mod_session response handling heap overflow
A heap overflow in Apache HTTP Server's mod_session allows attackers to execute arbitrary code or cause a denial of service via crafted headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-26691?
CVE-2021-26691 is a critical memory corruption vulnerability in Apache Http Server, published on 10 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow
Which versions are affected by CVE-2021-26691?
1 open source package ship an affected version, including apache. It affects 8 products.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | From 2.4.0 | 2.4.47 |
Products include Apache Http Server, Debian Debian Linux, Fedoraproject Fedora, Netapp Cloud Backup, Oracle Enterprise Manager Ops Center, Oracle Instantis Enterprisetrack and 2 more.
How do I fix CVE-2021-26691?
Upgrade apache to 2.4.47 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-26691 being exploited?
There is no known exploitation of CVE-2021-26691 in the wild and no public exploit code.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2021-26691, AZL-6477, BIT-apache-2021-26691, CLEANSTART-2026-QB44959, DEBIAN-CVE-2021-26691, GHSA-j3ww-p97m-gh9x and 1 more.