Vulnerabilities
Misconfiguration
Runtime Security
Compliance
CVE Vulnerabilities

CVE-2021-33193

Published: Aug 16, 2021 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
7.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Ubuntu
MEDIUM
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2021-33193
CWEhttps://cwe.mitre.org/data/definitions/NVD-Other.html

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

Affected Software

Name Vendor Start Version End Version
Http_server Apache 2.4.17 (including) 2.4.48 (including)
JBoss Core Services for RHEL 8 RedHat jbcs-httpd24-httpd-0:2.4.51-28.el8jbcs *
JBoss Core Services on RHEL 7 RedHat jbcs-httpd24-httpd-0:2.4.51-28.el7jbcs *
Red Hat Enterprise Linux 8 RedHat httpd:2.4-8060020220321163517.d63f516d *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat httpd24-httpd-0:2.4.34-23.el7.5 *
Text-Only JBCS RedHat httpd *
Apache2 Ubuntu bionic *
Apache2 Ubuntu devel *
Apache2 Ubuntu focal *
Apache2 Ubuntu hirsute *
Apache2 Ubuntu impish *
Apache2 Ubuntu jammy *
Apache2 Ubuntu trusty *
Apache2 Ubuntu upstream *
Apache2 Ubuntu xenial *

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2025 Aqua Security Software Ltd.   Privacy Policy | Terms of Use