CVE-2021-36160 mod_proxy_uwsgi out of bound read
A crafted request URI can cause mod_proxy_uwsgi to read out of bounds, crashing the Apache HTTP Server and causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-36160?
CVE-2021-36160 is a high-severity denial of service vulnerability in Apache Http Server, published on 16 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).
Weakness: CWE-125
Which versions are affected by CVE-2021-36160?
1 open source package ship an affected version, including apache. It affects 13 products.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | From 2.4.30 | 2.4.49 |
Products include Apache Http Server, Broadcom Brocade Fabric Operating System Firmware, Debian Debian Linux, Fedoraproject Fedora, Netapp Cloud Backup, Netapp Clustered Data Ontap and 7 more.
How do I fix CVE-2021-36160?
Upgrade apache to 2.4.49 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-36160 being exploited?
There is no known exploitation of CVE-2021-36160 in the wild and no public exploit code.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2021-36160, AZL-6485, BIT-apache-2021-36160, CLEANSTART-2026-WN13169, DEBIAN-CVE-2021-36160, DLA-2768-1 and 2 more.