CVE-2021-36160 — mod_proxy_uwsgi out of bound read

Description

A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache HTTP Server	Apache HTTP Server 2.4 – ≤ 2.4.48	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	apache2	2.4.49-1	—
Debian 14	uwsgi	No fix yet	—
Debian 13	apache2	2.4.49-1	—
Debian 13	uwsgi	No fix yet	—
Debian 12	apache2	2.4.49-1	—
Debian 12	uwsgi	No fix yet	—
Debian 11	apache2	2.4.51-1~deb11u1	DSA-4982-1
Debian 10	apache2	2.4.38-3+deb10u6	DSA-4982-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Debian 9	uwsgi	2.0.14+20161117-3+deb9u4	DLA-2768-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 20.04 LTS	apache2	2.4.41-4ubuntu3.5	USN-5090-1
Ubuntu 18.04 LTS	apache2	2.4.29-1ubuntu4.17	USN-5090-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 8	httpd +6	2.4.37-47.module+el8.6.0+14529+083145da.1	RHSA-2022:1915
RHEL 8	mod_http2	1.15.7-5.module+el8.6.0+13996+01710940	RHSA-2022:1915
RHEL 8	mod_md	1:2.0.8-8.module+el8.3.0+6814+67d1e611	RHSA-2022:1915
RHEL 8	mod_ssl +1	1:2.4.37-47.module+el8.6.0+14529+083145da.1	RHSA-2022:1915
RHEL 3	httpd24-httpd +5	2.4.34-23.el7.5	RHSA-2022:6753
RHEL 3	httpd24-mod_ssl +1	1:2.4.34-23.el7.5	RHSA-2022:6753

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat JBoss Core Services 1	jbcs-httpd24-httpd +6	2.4.51-28.el7jbcs	RHSA-2022:7143
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_ssl +1	1:2.4.51-28.el7jbcs	RHSA-2022:7143

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 8	httpd +6	2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma	ALSA-2022:1915
AlmaLinux 8	mod_http2	1.15.7-5.module_el8.6.0+2872+fe0ff7aa	ALSA-2022:1915
AlmaLinux 8	mod_md	1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa	ALSA-2022:1915
AlmaLinux 8	mod_ssl +1	1:2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma	ALSA-2022:1915

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 8	httpd	2.4.37-47.module+el8.6.0+823+f143cee1.1	RLSA-2022:1915
Rocky Linux 8	mod_http2	1.15.7-5.module+el8.6.0+823+f143cee1	RLSA-2022:1915
Rocky Linux 8	mod_md	1:2.0.8-8.module+el8.4.0+553+7a69454b	RLSA-2022:1915

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP3	apache2	2.4.43-3.32.1	SUSE-SU-2021:3522-1
SLES 15 SP2	apache2	2.4.43-3.32.1	SUSE-SU-2021:3522-1
SLES 15 SP1	apache2	2.4.33-3.55.1	SUSE-SU-2021:3335-1
SLES 15	apache2	2.4.33-3.55.1	SUSE-SU-2021:3335-1

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15 SP1	apache2	2.4.33-3.55.1	SUSE-SU-2021:3335-1
SLES for SAP 15	apache2	2.4.33-3.55.1	SUSE-SU-2021:3335-1
SLE HPC 15 SP1	apache2	2.4.33-3.55.1	SUSE-SU-2021:3335-1
SLE HPC 15	apache2	2.4.33-3.55.1	SUSE-SU-2021:3335-1
SUSE Enterprise Storage 6	apache2	2.4.33-3.55.1	SUSE-SU-2021:3335-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Leap 15.3	apache2	2.4.43-3.32.1	openSUSE-SU-2021:3522-1
openSUSE Leap 15.2	apache2	2.4.43-lp152.2.21.1	openSUSE-SU-2021:1438-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	apache2	2.4.49-r0	—
Alpine v3.23	apache2	2.4.49-r0	—
Alpine v3.22	apache2	2.4.49-r0	—
Alpine v3.21	apache2	2.4.49-r0	—
Alpine v3.20	apache2	2.4.49-r0	—

Show 9 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	apache2	2.4.49-r0	—
Alpine v3.18	apache2	2.4.49-r0	—
Alpine v3.17	apache2	2.4.49-r0	—
Alpine v3.16	apache2	2.4.49-r0	—
Alpine v3.15	apache2	2.4.49-r0	—
Alpine v3.14	apache2	2.4.49-r0	—
Alpine v3.13	apache2	2.4.49-r0	—
Alpine v3.12	apache2	2.4.49-r0	—
Alpine v3.11	apache2	2.4.49-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	httpd +7	2.4.51-1.amzn2	ALAS2-2021-1716
Amazon Linux 2	mod_ssl +1	1:2.4.51-1.amzn2	ALAS2-2021-1716

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 2 (CBL-Mariner)	httpd	2.4.52-1	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 8	httpd +6	2.4.37-47.0.1.module+el8.6.0+20649+083145da.1	ELSA-2022-1915
Oracle Linux 8	mod_http2	1.15.7-5.module+el8.6.0+20548+01710940	ELSA-2022-1915
Oracle Linux 8	mod_md	1:2.0.8-8.module+el8.5.0+20475+4f6a8fd5	ELSA-2022-1915
Oracle Linux 8	mod_ssl +1	1:2.4.37-47.0.1.module+el8.6.0+20649+083145da.1	ELSA-2022-1915

Advisories 16

ALSA-2022:1915 Moderate: httpd:2.4 security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2022:7143 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2022:6753 Red Hat Security Advisory: httpd24-httpd security and bug fix update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2022:1915 Red Hat Security Advisory: httpd:2.4 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 9, 2026
USN-5090-1 apache2 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
DSA-4982-1 apache2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-2768-1 uwsgi - security update Debian Security (DSA / DLA) · Mar 9, 2026
RLSA-2022:1915 Moderate: httpd:2.4 security and bug fix update Rocky Linux Security Advisories · Feb 4, 2026
SUSE-SU-2021:3335-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2021:3522-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:3522-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2021:1438-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2022-0724 Apache HTTP Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 29, 2025
WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
ELSA-2022-1915 Moderate: httpd:2.4 security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 17, 2022
ALAS2-2021-1716 Important: httpd security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 15, 2021

References

http://httpd.apache.org/security/vulnerabilities_24.html
[httpd-cvs] 20210916 [httpd-site] branch main updated: Revert "Add descriptions for CVE-2021-33193 CVE-2021-36160" mailing-list
[httpd-cvs] 20210916 [httpd-site] branch main updated: Add descriptions for CVE-2021-33193 CVE-2021-36160 mailing-list
FEDORA-2021-dce7e7738e vendor-advisory
[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info mailing-list
[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info mailing-list
[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info mailing-list
[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info mailing-list
FEDORA-2021-e3f6dd670d vendor-advisory
[debian-lts-announce] 20210929 [SECURITY] [DLA 2768-1] uwsgi security update mailing-list
[httpd-bugs] 20211005 [Bug 65616] New: CVE-2021-36160 regression mailing-list
[httpd-bugs] 20211005 [Bug 65616] CVE-2021-36160 regression mailing-list
[httpd-bugs] 20211006 [Bug 65616] CVE-2021-36160 regression mailing-list
[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression mailing-list
[httpd-bugs] 20211009 [Bug 65616] CVE-2021-36160 regression mailing-list
DSA-4982 vendor-advisory
[httpd-bugs] 20211011 [Bug 65616] CVE-2021-36160 regression mailing-list
[httpd-bugs] 20211012 [Bug 65616] CVE-2021-36160 regression mailing-list
[debian-lts-announce] 20211020 [SECURITY] [DLA 2768-2] uwsgi regression update mailing-list
20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021 vendor-advisory
https://www.oracle.com/security-alerts/cpujan2022.html
https://security.netapp.com/advisory/ntap-20211008-0004/
https://www.oracle.com/security-alerts/cpuapr2022.html
GLSA-202208-20 vendor-advisory