Vulnerabilities

TI-2021-19915 CVE-2021-44224 · GHSA-92ww-hwmg-qq7p

Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

HIGH 76

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.82295 Published 2021-12-20 Partial fix CWE-476

TI-2021-20274 CVE-2021-44790 · GHSA-c547-2659-q37g

Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier

CRITICAL 86

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.9684 Published 2021-12-20 Partial fix CWE-787

Vulnerabilities

Filters

Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier