CVE-2021-41773

CVE-2021-41773 Reproduction https://www.tenable.com/blog/cve-2021-41773-path-traversal-zero-day-in-apache-http-server-exploited v2.4.49 Apache unique vulnerability, earlier versions do not have the apnormalizepath function. This function was introduced in v2.4.49, and it is exactly this function...

CVE-2021-40438

CVE-2021-40438 exploit PoC with Docker setup CD into the directory containing the Apache configuration and Dockerfile shared in repo. Building Image: docker build -t cve-2021-40438:1.0 . Running the Docker Image: docker run --rm -d -p 4444:80 cve-2021-40438:1.0 Note: You can also use Image ID...

Astra Linux – Vulnerability in Apache2

The “Use After Free” vulnerability in the Apache HTTP Server module modhttp2 occurs when file handles are already exhausted. This issue affects Apache HTTP Server versions 2.4.55 through 2.4.67...

Astra Linux – Vulnerability in Apache2

Insufficient escaping of user-supplied data in modssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to log variables...

Astra Linux – Vulnerability in Apache2

A out-of-bounds read vulnerability exists in the modmacro module of the Apache HTTP Server. This issue affects the Apache HTTP Server version up to 2.4.57...

docker-lab-cve-2017-5638-cve-2021-41773

Attacker Lab: CVE-2017-5638 & CVE-2021-41773 A 7-host Docker-based attack emulation lab designed to demonstrate a multi-stage kill chain, lateral movement, and multi-point IDS detection. Overview This lab simulates a realistic network environment where an attacker progresses from initial...

httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc

A flaw was found in Apache HTTP Server, specifically within the modxml2enc module. This heap-based buffer overflow vulnerability can be triggered when processing untrusted content through the xml2StartParse function. A remote attacker could potentially exploit this to cause a denial of service,...

httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server

A flaw was found in Apache HTTP Server. This buffer over-read vulnerability occurs when the server processes outbound Online Certificate Status Protocol OCSP requests directed to an attacker-controlled OCSP server. This could allow a remote attacker to read sensitive information from memory or...

httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass

A vulnerability has been identified in the Apache HTTP Server. If the server is configured to connect to a malicious or compromised backend server, an attacker could exploit this flaw to bypass security controls or run unauthorized code on the system...

httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime

A flaw was found in Apache HTTP Server. An out-of-bounds read vulnerability exists when modheaders and modmime are used with multiple response languages. This could allow a remote attacker to disclose sensitive information from memory or cause a denial of service...

httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration

A flaw was found in Apache HTTP Server when using the modldap module in a per-directory configuration. This use-after-free vulnerability allows a remote attacker to potentially execute arbitrary code or cause a denial of service DoS due to improper memory handling. This could lead to system...

httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers

A flaw was found in Apache HTTP Server. This heap-based buffer overflow vulnerability can be exploited by a malicious backend server when using ProxyPassReverseCookie directives. This could lead to a denial of service DoS condition, making the server unavailable to legitimate users...

httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server

A flaw was found in the modproxyftp module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol FTP server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service DoS for the...

httpd: Apache HTTP Server: Denial of Service via crafted regular expressions

A flaw was found in Apache HTTP Server. This buffer underwrite vulnerability occurs when processing crafted regular expressions in the server's configuration. An attacker could potentially exploit this to cause a denial of service...

Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow

A flaw was found in modproxyajp of Apache HTTP Server. This heap-based buffer overflow vulnerability allows a remote attacker, by connecting to a malicious AJP Apache JServ Protocol server, to send a specially crafted message. This message can cause modproxyajp to write attacker-controlled data...

cve-2021-41773

CVE-2021-41773 – Apache Path Traversal Report Summary Vulnerability found in Apache HTTP Server 2.4.49 that can expose sensitive files on the system through a Path Traversal attack depending on the web server configuration Path Traversal: An attacker can access files outside the web root using...

CVE-2021-41773

CVE-2021-41773 - Apache HTTP Server 2.4.49 How to Run the CVE-2021-41773-Path Traversal Lab 1. Install and run Docker on your PC/Laptop 2. Clone this github repo 3. Go to the Path Traversal folder 4. Enter the following commands docker build -t cve-2021-41773-path-traversal . and docker run --rm...

Preproduce-CVE-2021-41773

Preproduce CVE 2021-41773 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 CVE-2021-41773 POC root@kitploit: $ docker compose up Confirm it works root@kitploit: $ curl -I http://localhost HTTP/1.1 200 OK Date: Wed, 06 Oct 2021 13:25:18 GMT Server: Apache/2.4.49 Unix...

CVE-2026-42536-PoC

CVE-2026-42536: Apache HTTP Server modxml2enc Heap Overflow PoC This PoC code is part of the blog post at https://erberkan.github.io/2026/PatchDiffingandN-DayDefense/ . This repository contains a controlled proof of concept for CVE-2026-42536, a heap-based out-of-bounds write in Apache HTTP...

CVE-2021-41773-RedTeam

CVE-2021-41773 — Apache HTTP Server 2.4.49 Path Traversal / RCE ITSOLERA Cybersecurity Department — Red Team Task 3 Team: Offensive Team Zeta Date: 18th March 2026 ⚠️ Disclaimer This repository is for educational purposes only. All testing was performed in an isolated local Docker lab. Never use...