CLEANSTART-2026-XX88354 crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning

🗓️ 09 Oct 2026 00:49:54Reported by GoogleType

osv-cleanstart🔗 osv.dev👁 4 Views

Crafted HTTP/2 method in apache2 mod_proxy bypasses validation leading to cache poisoning.

Reporter	Title	Published	Views	Family All 146
IBM Security Bulletins	Security Bulletin: IBM Rational Build Forge 8.0.x is affected by Apache HTTP Server version used in it. (CVE-2021-33193)	17 Jan 202218:26	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Apache HTTP Server affect IBM i	24 Sep 202122:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Aspera Faspex 4.4.2 has addressed multiple security vulnerabilities	7 Sep 202223:27	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache HTTP (CVE-2021-33193 and CVE-2021-44224) affects Power HMC	4 Dec 202200:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Aspera Orchestrator affected by HTTP request splitting attack due to Apache HTTP Server vulnerability (CVE-2021-33193)	2 Feb 202320:39	–	ibm
FreeBSD	Apache httpd -- multiple vulnerabilities	16 Sep 202100:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 9 package apache2 version 1:2.4.49-alt1	23 Sep 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package apache2 version 1:2.4.49-alt1	4 Oct 202100:00	–	altlinux
attackerkb	CVE-2021-33193	16 Aug 202108:15	–	attackerkb
Tenable Nessus	Amazon Linux 2 : httpd (ALAS-2021-1716)	16 Oct 202100:00	–	nessus

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-XX88354.json
osv	www.osv.dev/vulnerability/CVE-2021-33193
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-33193

09 Oct 2026 01:00Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.17.5

EPSS0.46179

apache2 mod_proxy HTTP/2 request splitting cache poisoning