CVE-2021-41973: vulnerability in Apache MINA
Apache MINA HTTP listener DOS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 4.6%
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
Affected products
Apache Software Foundation · Apache MINARelated CVEs — Apache MINA
In the same product, most dangerous first.
CVE-2024-52046CRITICALApache MINA: MINA applications using unbounded deserialization may allow RCEEPSS 24.4%CVE-2019-0231—Apache MINA SSLFilter security IssueEPSS 2.1%CVE-2026-42779CRITICALApache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)EPSS 1.2%CVE-2026-42778CRITICALApache MINA: CWE-502 Deserialization of Untrusted Data (take 2)EPSS 0.7%CVE-2026-41635CRITICALApache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCEEPSS 0.6%CVE-2026-118636CRITICALApache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoderEPSS 0.6%