CVE-2021-33193

🗓️ 16 Aug 2021 00:00:00Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 1731 Views

HTTP/2 request validation bypass in Apache HTTP Server

Reporter	Title	Published	Views	Family All 144
IBM Security Bulletins	Security Bulletin: IBM Rational Build Forge 8.0.x is affected by Apache HTTP Server version used in it. (CVE-2021-33193)	17 Jan 202218:26	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Apache HTTP Server affect IBM i	24 Sep 202122:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Aspera Faspex 4.4.2 has addressed multiple security vulnerabilities	7 Sep 202223:27	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache HTTP (CVE-2021-33193 and CVE-2021-44224) affects Power HMC	4 Dec 202200:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Aspera Orchestrator affected by HTTP request splitting attack due to Apache HTTP Server vulnerability (CVE-2021-33193)	2 Feb 202320:39	–	ibm
FreeBSD	Apache httpd -- multiple vulnerabilities	16 Sep 202100:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 9 package apache2 version 1:2.4.49-alt1	23 Sep 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package apache2 version 1:2.4.49-alt1	4 Oct 202100:00	–	altlinux
Tenable Nessus	Amazon Linux 2 : httpd (ALAS-2021-1716)	16 Oct 202100:00	–	nessus
Tenable Nessus	Amazon Linux AMI : httpd24 (ALAS-2021-1543)	17 Oct 202100:00	–	nessus

NVD

Vulners

Node

debian debian_linuxMatch10.0

Node

apache http_serverRange2.4.17–2.4.49

Node

fedoraproject fedoraMatch34

fedoraproject fedoraMatch35

Node

tenable tenable.scRange≤5.19.1

Node

oracle secure_backupRange<18.1.0.1.0

oracle zfs_storage_appliance_kitMatch8.8

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache HTTP Server",
    "versions": [
      {
        "version": "Apache HTTP Server 2.4 2.4.17 to 2.4.48",
        "status": "affected"
      }
    ]
  }
]

Source	Link
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
oracle	www.oracle.com/security-alerts/cpuapr2022.html
github	www.github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
lists	www.lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d%40%3Ccvs.httpd.apache.org%3E
lists	www.lists.debian.org/debian-lts-announce/2023/03/msg00002.html
security	www.security.gentoo.org/glsa/202208-20
portswigger	www.portswigger.net/research/http2
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
security	www.security.netapp.com/advisory/ntap-20210917-0004/
lists	www.lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70%40%3Ccvs.httpd.apache.org%3E

01 May 2025 15:40Current

7.8High risk

Vulners AI Score7.8

CVSS 25

CVSS 3.17.5

EPSS0.00609