CVE-2021-22050: VMware Cloud Foundation

High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days.

ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy. A malicious actor with network access to ESXi may exploit this issue to create a denial-of-service condition by overwhelming rhttpproxy service with multiple requests.

Affected products

• VMware Cloud Foundation: from 3.0, before 3.11 (fixed in 3.11); from 4.0, before 4.4 (fixed in 4.4)
• VMware ESXi: version 6.5 only; version 6.7 only; version 7.0 only

Published 2022-02-16. Last modified 2026-06-17.