CVE-2021-41973 Apache MINA HTTP listener DOS
A malformed HTTP request can cause the Apache MINA HTTP Header decoder to loop indefinitely, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-41973?
CVE-2021-41973 is a medium-severity denial of service vulnerability in Oracle Flexcube Universal Banking, published on 1 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
Weakness: CWE-835
Which versions are affected by CVE-2021-41973?
4 open source packages ship an affected version, including org.apache.mina:mina-core. It affects 9 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.mina:mina-core Maven | All versions | 2.0.22 |
org.apache.mina:mina-core Maven | All versions | 2.0.22 |
org.apache.mina:mina-core Maven | From 2.1.0 | 2.1.5 |
org.apache.mina:mina-core Maven | From 2.1.0 | 2.1.5 |
Products include Apache Mina, Oracle Banking Payments, Oracle Banking Trade Finance Process Management, Oracle Banking Treasury Management, Oracle Communications Cloud Native Core Console, Oracle Customer Management and Segmentation Foundation and 3 more.
How do I fix CVE-2021-41973?
Upgrade org.apache.mina:mina-core to a fixed version for your release line: 2.0.22 or 2.1.5.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-41973 being exploited?
There is no known exploitation of CVE-2021-41973 in the wild and no public exploit code.
Other vulnerabilities in Oracle Flexcube Universal Banking
- CVE-2024-52046 Apache MINA: MINA applications using unbounded deserialization may allow RCE
- CVE-2026-47065 Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232
- CVE-2026-42778 Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)
- CVE-2026-42779 Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix)
- CVE-2026-41409 Apache MINA: CWE-502 Deserialization of Untrusted Data
Sources
Also known as CLEANSTART-2026-YP61169, DEBIAN-CVE-2021-41973, GHSA-6mcm-j9cj-3vc3, OESA-2021-1435, UBUNTU-CVE-2021-41973.