CVE-2021-41973: Apache Mina

Medium severity, CVSS 6.5. EPSS: 4.6% chance of exploitation in the next 30 days.

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.

Affected products

• Apache Mina: before 2.0.22 (fixed in 2.0.22); from 2.1.0, before 2.1.5 (fixed in 2.1.5)
• Oracle Banking Payments: version 14.5 only
• Oracle Banking Trade Finance Process Management: version 14.5 only
• Oracle Banking Treasury Management: version 14.5 only
• Oracle Communications Cloud Native Core Console: version 1.9.0 only
• Oracle Customer Management And Segmentation Foundation: version 18.0 only; version 19.0 only
• Oracle Flexcube Universal Banking: from 14.0, up to and including 14.3; version 14.5 only
• Oracle Fusion Middleware Common Libraries And Tools: version 12.2.1.3.0 only; version 12.2.1.4.0 only; version 14.1.1.0.0 only
• Oracle OSS Support Tools: version 2.12.42 only

Published 2021-11-01. Last modified 2026-06-17.