CVE-2021-44224: Apache HTTP Server

High severity, CVSS 8.2. EPSS: 82.3% chance of exploitation in the next 30 days.

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

Affected products

• Apache HTTP Server: from 2.4.7, before 2.4.52 (fixed in 2.4.52)
• Apple Mac OS X: version 10.15.7 only
• Apple macOS: before 10.15.7 (fixed in 10.15.7); from 11.0, before 11.6.6 (fixed in 11.6.6); from 12.0.0, before 12.4 (fixed in 12.4)
• Debian Debian Linux: version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 34 only; version 35 only; version 36 only
• Oracle Communications Element Manager: before 9.0 (fixed in 9.0)
• Oracle Communications Operations Monitor: version 4.0 only; version 4.3 only; version 4.4 only; version 5.0 only
• Oracle Communications Session Report Manager: before 9.0 (fixed in 9.0)
• Oracle Communications Session Route Manager: before 9.0 (fixed in 9.0)
• Oracle HTTP Server: affected versions not specified; version 12.2.1.3.0 only; version 12.2.1.4.0 only
• Oracle Instantis Enterprisetrack: version 17.1 only; version 17.2 only; version 17.3 only
• Tenable Tenable.sc: from 5.14.0, before 5.20.0 (fixed in 5.20.0); from 5.16.0, before 202201.1 (fixed in 202201.1)

Published 2021-12-20. Last modified 2026-06-17.