CVE-2021-33193: Apache HTTP Server

High severity, CVSS 7.5. EPSS: 46.2% chance of exploitation in the next 30 days.

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

Affected products

• Apache HTTP Server: from 2.4.17, before 2.4.49 (fixed in 2.4.49)
• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 34 only; version 35 only
• Oracle Secure Backup: before 18.1.0.1.0 (fixed in 18.1.0.1.0)
• Oracle ZFS Storage Appliance Kit: version 8.8 only
• Tenable Tenable.sc: up to and including 5.19.1

Published 2021-08-16. Last modified 2026-06-17.