CVE-2021-26691

Description

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

How to fix CVE-2021-26691

To remediate CVE-2021-26691, upgrade the affected package to a fixed version below.

• Alpine/apache2—upgrade to 2.4.48-r0 or later
• Bitnami/apache—upgrade to 2.4.47 or later
• —upgrade to 2.4.46-6 or later

Is CVE-2021-26691 being exploited?

Likely — EPSS is 68.1%, placing CVE-2021-26691 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (3)

• from 0, < 2.4.48-r0
• >= 2.4.0, < 2.4.47
• from 0, < 2.4.46-6

CVSS scores

References (16)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-26691
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2021-26691
• WEBhttpd.apache.org/security/vulnerabilities_24.html
• WEBwww.openwall.com/lists/oss-security/2021/06/10/7