CVE-2021-41524: Apache HTTP Server

High severity, CVSS 7.5. EPSS: 25.2% chance of exploitation in the next 30 days.

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

Affected products

• Apache HTTP Server: version 2.4.49 only
• Fedoraproject Fedora: version 34 only; version 35 only
• Netapp Cloud Backup: affected versions not specified
• Oracle Instantis Enterprisetrack: version 17.1 only; version 17.2 only; version 17.3 only

Published 2021-10-05. Last modified 2026-06-17.