CVE-2021-26691CWE-122

CVE-2021-26691: vulnerability in Apache HTTP Server

Apache HTTP Server mod_session response handling heap overflow

Published · Updated

Follow this CVE+ Monitor Apache HTTP Server+ Monitor apache2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

15Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 68%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
3 products (12 components)
Red Hat Software Collections · Red Hat JBoss Enterprise Application Platform 6 · Red Hat JBoss Enterprise Web Server 2
workaround: Only configurations which use the "SessionEnv" directive (which is not widely used) are vulnerable to this flaw. SessionEnv is not enabled in default configuration of httpd package shipped with Red Hat Products.
Fixed
10 products (297 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat JBoss Core Services on RHEL 8 · Red Hat JBoss Core Services on RHEL 7 Server · Red Hat Enterprise Linux Server (v. 7) · Red Hat Enterprise Linux Server Optional (v. 7) · and others 5
fix ↗
Not affected
2 products (18 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 6
In short

Apache HTTP Server versions 2.4.0 to 2.4.46 are vulnerable to a heap overflow when processing specially crafted session headers from a server. An attacker could potentially crash the server or execute arbitrary code by sending a malicious session header.

Technical detail

A heap buffer overflow exists in mod_session's response header handling (CWE-122) affecting Apache 2.4.0–2.4.46. The vulnerability is triggered when an origin server sends a crafted SessionHeader that exceeds expected buffer boundaries, allowing remote code execution or denial of service without authentication.

Summary generated and translated by AI from the official description.
In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow
Affected products
Apache Software Foundation · Apache HTTP Server
Related CVEs — Apache HTTP Server

In the same product, most dangerous first.

CVE-2021-40438CRITICALmod_proxy SSRFEPSS 100.0%KEVCVE-2021-41773HIGHPath traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49EPSS 100.0%KEVCVE-2021-42013CRITICALPath Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)EPSS 100.0%KEVCVE-2024-38475CRITICALApache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.EPSS 100.0%KEVCVE-2021-44790—Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlierEPSS 96.8%CVE-2017-9798—CVE-2017-9798EPSS 94.7%