CVE-2021-34798: Apache HTTP Server

High severity, CVSS 7.5. EPSS: 64.5% chance of exploitation in the next 30 days.

Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.

Affected products

Apache HTTP Server: up to and including 2.4.48
Broadcom Brocade Fabric Operating System Firmware: affected versions not specified
Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
Fedoraproject Fedora: version 34 only; version 35 only
Netapp Cloud Backup: affected versions not specified
Netapp Clustered Data Ontap: affected versions not specified
Netapp Storagegrid: affected versions not specified
Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 1.10.0 only
Oracle Enterprise Manager Base Platform: version 13.4.0.0 only; version 13.5.0.0 only
Oracle HTTP Server: version 12.2.1.3.0 only; version 12.2.1.4.0 only
Oracle Instantis Enterprisetrack: version 17.1 only; version 17.2 only; version 17.3 only
Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only
Oracle ZFS Storage Appliance Kit: version 8.8 only
Siemens Ruggedcom Nms: any version
Siemens Sinec Nms: any version
Siemens Sinema Remote Connect Server: before 3.1 (fixed in 3.1)
Siemens Sinema Server: version 14.0 only
Tenable Tenable.sc: up to and including 5.19.1

Published 2021-09-16. Last modified 2026-06-17.