CVE-2021-39275: Apache HTTP Server

Critical severity, CVSS 9.8. EPSS: 39.4% chance of exploitation in the next 30 days.

ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.

Affected products

• Apache HTTP Server: before 2.4.49 (fixed in 2.4.49)
• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 34 only; version 35 only
• Netapp Cloud Backup: affected versions not specified
• Netapp Clustered Data Ontap: affected versions not specified
• Netapp Storagegrid: affected versions not specified
• Oracle HTTP Server: version 12.2.1.3.0 only; version 12.2.1.4.0 only
• Oracle Instantis Enterprisetrack: version 17.1 only; version 17.2 only; version 17.3 only
• Oracle ZFS Storage Appliance Kit: version 8.8 only
• Siemens Sinec Nms: any version
• Siemens Sinema Server: version 14.0 only

Published 2021-09-16. Last modified 2026-06-17.