Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2021-33193

Published: Aug 16, 2021 | Modified: May 01, 2025
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
7.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2021-33193
CWEhttps://cwe.mitre.org/data/definitions/NVD-Other.html

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

Affected Software

Name Vendor Start Version End Version
Debian_linux Debian 10.0 (including) 10.0 (including)
JBoss Core Services for RHEL 8 RedHat jbcs-httpd24-httpd-0:2.4.51-28.el8jbcs *
JBoss Core Services on RHEL 7 RedHat jbcs-httpd24-httpd-0:2.4.51-28.el7jbcs *
Red Hat Enterprise Linux 8 RedHat httpd:2.4-8060020220321163517.d63f516d *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat httpd24-httpd-0:2.4.34-23.el7.5 *
Text-Only JBCS RedHat httpd *
Apache2 Ubuntu bionic *
Apache2 Ubuntu devel *
Apache2 Ubuntu esm-infra/bionic *
Apache2 Ubuntu esm-infra/focal *
Apache2 Ubuntu focal *
Apache2 Ubuntu hirsute *
Apache2 Ubuntu impish *
Apache2 Ubuntu jammy *
Apache2 Ubuntu trusty *
Apache2 Ubuntu upstream *
Apache2 Ubuntu xenial *

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2025 Aqua Security Software Ltd.   Privacy Policy | Terms of Use