Apache MINA HTTP listener DOS
Priority LOW 36CWE-835Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 9 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.
Summary
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
Why it matters now
EPSS 0.04634 91st percentileScored 2026-11-07
Fix Partial Apache MINA (Apache Software Foundation): 2.1.5org.apache.mina:mina-core (Maven): 2.1.5, 2.0.22Red Hat: 9 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache MINA | Apache MINA to before 2.1.5 | 2.1.5 | Patch available | CNA |
| — | org.apache.mina:mina-core (Maven) | 2.1.0 to before 2.1.5 | 2.1.5 | Patch available | GHSA-6mcm-j9cj-3vc3 |
| — | org.apache.mina:mina-core (Maven) | before 2.0.22 | 2.0.22 | Patch available | GHSA-6mcm-j9cj-3vc3 |
- Apache MINA VendorApache Affected Apache MINA to before 2.1.5 Fixed in 2.1.5 Patch available CNA
- org.apache.mina:mina-core (Maven) Vendor— Affected 2.1.0 to before 2.1.5 Fixed in 2.1.5 Patch available GHSA-6mcm-j9cj-3vc3
- org.apache.mina:mina-core (Maven) Vendor— Affected before 2.0.22 Fixed in 2.0.22 Patch available GHSA-6mcm-j9cj-3vc3
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:mina:*:*:*:*:*:*:*:* | before 2.0.22; 2.1.0 to before 2.1.5 | Vulnerable | Apache |
| cpe:2.3:a:oracle:banking_payments:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:* | 1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:* | 18.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* | 19.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:* | 14.0 – 14.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_universal_banking:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:fusion_middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
- cpe:2.3:a:apache:mina:*:*:*:*:*:*:*:* Versions before 2.0.22; 2.1.0 to before 2.1.5 Vulnerable ·Apache
- cpe:2.3:a:oracle:banking_payments:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:* Versions 18.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* Versions 19.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:* Versions 14.0 – 14.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_universal_banking:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:fusion_middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
Show 3 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:fusion_middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:fusion_middleware_common_libraries_and_tools:14.1.1.0.0:*:*:*:*:*:*:* | 14.1.1.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:oss_support_tools:2.12.42:*:*:*:*:*:*:* | 2.12.42 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:fusion_middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:fusion_middleware_common_libraries_and_tools:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:oss_support_tools:2.12.42:*:*:*:*:*:*:* Versions 2.12.42 Vulnerable ·Oracle
Remediation
- Fix · CNA Apache MINA (Apache Software Foundation) Fixed in 2.1.5
- Fix · GHSA-6mcm-j9cj-3vc3 org.apache.mina:mina-core (Maven) Fixed in 2.1.5 Advisory →
- Fix · GHSA-6mcm-j9cj-3vc3 org.apache.mina:mina-core (Maven) Fixed in 2.0.22 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Out of support scope |
Not affected: 3 products
- Red Hat Fuse 7
- Red Hat Integration Camel K 1
- Red Hat Integration Camel Quarkus 1
Timeline
- 2026-10-02 Threatist record created from CVE-2021-41973
- 2026-10-03 Alias added: GHSA-6mcm-j9cj-3vc3
References
Patch 3
More Apache Mina vulnerabilities
- TI-2024-34922 Apache MINA: MINA applications using unbounded deserialization may allow RCE CVSS 4.0CRITICAL 10.0
- TI-2026-31001 Deserialization of untrusted data in Apache MINA CVSS 3.1CRITICAL 9.8
- TI-2026-31000 Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2) CVSS 3.1CRITICAL 9.8
- TI-2026-30156 Deserialization of untrusted data in Apache MINA CVSS 3.1CRITICAL 9.8
- TI-2026-34667 Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232 CVSS 3.1CRITICAL 9.8
- TI-2026-30010 Apache MINA: CWE-502 Deserialization of Untrusted Data CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-41973 · CVE Program
- CVE-2021-41973 · NVD
- FIRST EPSS
- GHSA-6mcm-j9cj-3vc3 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-41973 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences