CVE-2021-36160: mod_proxy_uwsgi out of bound read

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 62.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-16 · updated 2026-06-17
Weakness: CWE-125

Description

A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).

Affected products

Apache HTTP Server: from 2.4.30 before 2.4.49 — fixed in 2.4.49
Broadcom Brocade Fabric Operating System Firmware: all versions
Debian Linux: 9.0, 10.0, 11.0
Fedoraproject Fedora: 34, 35
NetApp Cloud Backup: all versions
Clustered Data ONTAP: all versions
NetApp StorageGRID: all versions
Oracle Communications Cloud Native Core Network Function Cloud Native Environment: 1.10.0
Oracle Corporation Enterprise Manager Base Platform: 13.4.0.0, 13.5.0.0
Oracle Corporation Oracle HTTP Server: 12.2.1.3.0, 12.2.1.4.0
Oracle Instantis Enterprisetrack: 17.1, 17.2, 17.3
Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58
Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8

How to fix

Upgrade to a fixed version: Apache HTTP Server 2.4.49. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-36160 or the next vulnerability affects your stack