CVE-2021-44224 Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

What is CVE-2021-44224?

CVE-2021-44224 is a high-severity vulnerability in Apache Http Server, published on 20 Dec 2021.

Official description

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

Weakness: CWE-476

Which versions are affected by CVE-2021-44224?

1 open source package ship an affected version, including apache. It affects 12 products.

Products include Apache Http Server, Apple Mac Os X, Apple Macos, Debian Debian Linux, Fedoraproject Fedora, Oracle Communications Element Manager and 6 more.

How do I fix CVE-2021-44224?

Upgrade apache to 2.4.52 or later.

Is CVE-2021-44224 being exploited?

There is no known exploitation of CVE-2021-44224 in the wild and no public exploit code.

Other vulnerabilities in Apache Http Server

• CVE-2021-42013 Apache HTTP Server Path Traversal Exploited Critical 9.8
• CVE-2024-38475 Apache HTTP Server Improper Escaping of Output Exploited Critical 9.1
• CVE-2021-40438 Apache HTTP Server-Side Request Forgery (SSRF) Exploited Critical 9.0
• CVE-2019-0211 Apache HTTP Server Privilege Escalation Exploited High 7.8
• CVE-2021-41773 Apache HTTP Server Path Traversal Exploited High 7.5

All Apache Http Server vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2021-44224, AZL-7043, BIT-apache-2021-44224, CLEANSTART-2026-GK10724, DEBIAN-CVE-2021-44224, GHSA-92ww-hwmg-qq7p and 1 more.