CVE-2021-36160: Apache HTTP Server

High severity, CVSS 7.5. EPSS: 62.9% chance of exploitation in the next 30 days.

A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).

Affected products

• Apache HTTP Server: from 2.4.30, before 2.4.49 (fixed in 2.4.49)
• Broadcom Brocade Fabric Operating System Firmware: affected versions not specified
• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 34 only; version 35 only
• Netapp Cloud Backup: affected versions not specified
• Netapp Clustered Data Ontap: affected versions not specified
• Netapp Storagegrid: affected versions not specified
• Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 1.10.0 only
• Oracle Enterprise Manager Base Platform: version 13.4.0.0 only; version 13.5.0.0 only
• Oracle HTTP Server: version 12.2.1.3.0 only; version 12.2.1.4.0 only
• Oracle Instantis Enterprisetrack: version 17.1 only; version 17.2 only; version 17.3 only
• Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only
• Oracle ZFS Storage Appliance Kit: version 8.8 only

Published 2021-09-16. Last modified 2026-06-17.