CVE-2021-44224
published 2021-12-20CVE-2021-44224: A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward…
PriorityP264high8.2CVSS 3.1
AVNACLPRNUINSUCNILAH
EPSS
82.30%
99.6th percentile
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.4.7 < 2.4.52 | 2.4.52 |
| apache_software_foundation | apache_http_server | >= 2.4.7 < Apache HTTP Server 2.4* | Apache HTTP Server 2.4* |
| apple | mac_os_x | — | — |
| apple | macos | < 10.15.7 | 10.15.7 |
| apple | macos | >= 11.0 < 11.6.6 | 11.6.6 |
| apple | macos | >= 12.0.0 < 12.4 | 12.4 |
| apple | macos_big_sur | — | — |
| apple | macos_monterey | — | — |
| apple | security_update_2022-004_catalina | — | — |
| debian | apache2 | < apache2 2.4.52-1 (bookworm) | apache2 2.4.52-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cbl2_httpd_2.4.52-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_httpd_2.4.52-1_on_cbl_mariner_1.0 | — | — |
| oracle | communications_element_manager | < 9.0 | 9.0 |
| oracle | communications_operations_monitor | — | — |
| oracle | communications_operations_monitor | — | — |
| oracle | communications_operations_monitor | — | — |
| oracle | communications_operations_monitor | — | — |
| oracle | communications_session_report_manager | < 9.0 | 9.0 |
| oracle | communications_session_route_manager | < 9.0 | 9.0 |
| oracle | http_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Target Apache HTTP Server configured as a forward proxy (ProxyRequests on); a crafted URI triggers NULL pointer dereference (DoS) or SSRF via Unix Domain Socket endpoint redirection ↗
- →Exploitation vector is adjacent network; monitor for crafted packets sent to the forward proxy that result in unexpected Unix Domain Socket connections or proxy crashes ↗
- →Vulnerable component is mod_proxy in Apache HTTP Server 2.4.7 through 2.4.51; alert on these version strings in server banners or package inventory ↗
- ·Vulnerability only affects httpd instances where ProxyRequests is explicitly turned ON (forward proxy mode); reverse-proxy-only configurations are not affected by the crash vector ↗
- ·SSRF to Unix Domain Socket endpoints requires a mixed forward+reverse proxy configuration; pure forward-proxy setups are limited to the NULL dereference/DoS impact ↗
- ·Affected version range is Apache HTTP Server 2.4.7 up to and including 2.4.51; fixed in 2.4.52 ↗
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:P
osv8.2HIGH
vendor_debian8.2HIGH
vendor_msrc8.2HIGH
vendor_redhat8.2HIGH
vendor_ubuntu8.2HIGH
vendor_oracle6.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-92ww-hwmg-qq7p: A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixin
ghsa_unreviewed·2022-02-08
CVE-2021-44224 [HIGH] CWE-476 GHSA-92ww-hwmg-qq7p: A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixin
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
OSV
apache2 vulnerabilities
osv·2022-01-10·CVSS 8.2
CVE-2021-44224 [HIGH] apache2 vulnerabilities
apache2 vulnerabilities
USN-5212-1 fixed several vulnerabilities in Apache. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that the Apache HTTP Server incorrectly handled certain
forward proxy requests. A remote attacker could use this issue to cause
the server to crash, resulting in a denial of service, or possibly perform
a Server Side Request Forgery attack. (CVE-2021-44224)
It was discovered that the Apache HTTP Server Lua module incorrectly
handled memory in the multipart parser. A remote attacker could use this
issue to cause the server to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2021-44790)
OSV
apache2 vulnerabilities
osv·2022-01-06·CVSS 8.2
CVE-2021-44224 [HIGH] apache2 vulnerabilities
apache2 vulnerabilities
It was discovered that the Apache HTTP Server incorrectly handled certain
forward proxy requests. A remote attacker could use this issue to cause
the server to crash, resulting in a denial of service, or possibly perform
a Server Side Request Forgery attack. (CVE-2021-44224)
It was discovered that the Apache HTTP Server Lua module incorrectly
handled memory in the multipart parser. A remote attacker could use this
issue to cause the server to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2021-44790)
OSV
CVE-2021-44224: A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixin
osv·2021-12-20·CVSS 8.2
CVE-2021-44224 [HIGH] CVE-2021-44224: A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixin
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
Apple
CVE-2021-44224: Security Update 2022-004 Catalina
vendor_apple·2022-05-16·CVSS 8.2
CVE-2021-44224 [HIGH] CVE-2021-44224: Security Update 2022-004 Catalina
Apple Security Update: About the security content of Security Update 2022-004 Catalina
Product: Security Update 2022-004 Catalina
CVE: CVE-2021-44224
Component: CVE-2021-44224
Apple
CVE-2021-44224: macOS Big Sur 11.6.6
vendor_apple·2022-05-16·CVSS 8.2
CVE-2021-44224 [HIGH] CVE-2021-44224: macOS Big Sur 11.6.6
Apple Security Update: About the security content of macOS Big Sur 11.6.6
Product: macOS Big Sur
Version: 11.6.6
CVE: CVE-2021-44224
Component: CVE-2021-44224
Apple
CVE-2021-44224: macOS Monterey 12.4
vendor_apple·2022-05-16·CVSS 8.2
CVE-2021-44224 [HIGH] CVE-2021-44224: macOS Monterey 12.4
Apple Security Update: About the security content of macOS Monterey 12.4
Product: macOS Monterey
Version: 12.4
CVE: CVE-2021-44224
Component: CVE-2021-44224
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (Apache HTTP Server) — CVE-2021-44224
vendor_oracle·2022-04-15·CVSS 6.5
CVE-2021-44224 [HIGH] Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (Apache HTTP Server) — CVE-2021-44224
Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (Apache HTTP Server) vulnerability
CVE: CVE-2021-44224
CVSS: 6.5
Protocol: HTTPS
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2022-01-10·CVSS 8.2
CVE-2021-44790 [HIGH] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
USN-5212-1 fixed several vulnerabilities in Apache. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that the Apache HTTP Server incorrectly handled certain
forward proxy requests. A remote attacker could use this issue to cause
the server to crash, resulting in a denial of service, or possibly perform
a Server Side Request Forgery attack. (CVE-2021-44224)
It was discovered that the Apache HTTP Server Lua module incorrectly
handled memory in the multipart parser. A remote attacker could use this
issue to cause the server to crash, resulting in a denial of service, or
possibly execute arbitrary
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2022-01-06·CVSS 8.2
CVE-2021-44790 [HIGH] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
It was discovered that the Apache HTTP Server incorrectly handled certain
forward proxy requests. A remote attacker could use this issue to cause
the server to crash, resulting in a denial of service, or possibly perform
a Server Side Request Forgery attack. (CVE-2021-44224)
It was discovered that the Apache HTTP Server Lua module incorrectly
handled memory in the multipart parser. A remote attacker could use this
issue to cause the server to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2021-44790)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
httpd: possible NULL dereference or SSRF in forward proxy configurations
vendor_redhat·2021-12-20·CVSS 8.2
CVE-2021-44224 [HIGH] CWE-918 httpd: possible NULL dereference or SSRF in forward proxy configurations
httpd: possible NULL dereference or SSRF in forward proxy configurations
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
There's a null pointer dereference and server-side request forgery flaw in httpd's mod_proxy module, when it is configured to be used as a forward proxy. A crafted packet could be sent on the adjacent network to the forward proxy that could cause a crash, or potentially SSRF via misdirected Unix Domain Socket requests. In the worst case, this could ca
Microsoft
Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier
vendor_msrc·2021-12-14·CVSS 8.2
CVE-2021-44224 [HIGH] CWE-476 Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier
Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
apache: apache
Customer Action Required: Yes
Remedi
Debian
CVE-2021-44224: apache2 - A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can...
vendor_debian·2021·CVSS 8.2
CVE-2021-44224 [HIGH] CVE-2021-44224: apache2 - A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can...
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
Scope: local
bookworm: resolved (fixed in 2.4.52-1)
bullseye: resolved (fixed in 2.4.52-1~deb11u2)
forky: resolved (fixed in 2.4.52-1)
sid: resolved (fixed in 2.4.52-1)
trixie: resolved (fixed in 2.4.52-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2021-44224 httpd: possible NULL dereference or SSRF in forward proxy configurations
bugzilla·2021-12-21·CVSS 8.2
CVE-2021-44224 [HIGH] CVE-2021-44224 httpd: possible NULL dereference or SSRF in forward proxy configurations
CVE-2021-44224 httpd: possible NULL dereference or SSRF in forward proxy configurations
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
References:
http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
Discussion:
Created httpd tracking bugs for this issue:
Affects: fedora-all [bug 2034673]
---
Potentially relevant upstream commits:
https://svn.apache.org/viewvc?view=revision&revision=1895921
https://svn.ap
Tenable
Oracle April 2022 Critical Patch Update Addresses 221 CVEs
blogs_tenable·2022-04-20
Oracle April 2022 Critical Patch Update Addresses 221 CVEs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
http://httpd.apache.org/security/vulnerabilities_24.htmlhttp://seclists.org/fulldisclosure/2022/May/33http://seclists.org/fulldisclosure/2022/May/35http://seclists.org/fulldisclosure/2022/May/38http://www.openwall.com/lists/oss-security/2021/12/20/3https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/https://security.gentoo.org/glsa/202208-20https://security.netapp.com/advisory/ntap-20211224-0001/https://support.apple.com/kb/HT213255https://support.apple.com/kb/HT213256https://support.apple.com/kb/HT213257https://www.debian.org/security/2022/dsa-5035https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.tenable.com/security/tns-2022-01https://www.tenable.com/security/tns-2022-03http://httpd.apache.org/security/vulnerabilities_24.htmlhttp://seclists.org/fulldisclosure/2022/May/33http://seclists.org/fulldisclosure/2022/May/35http://seclists.org/fulldisclosure/2022/May/38http://www.openwall.com/lists/oss-security/2021/12/20/3https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/https://security.gentoo.org/glsa/202208-20https://security.netapp.com/advisory/ntap-20211224-0001/https://support.apple.com/kb/HT213255https://support.apple.com/kb/HT213256https://support.apple.com/kb/HT213257https://www.debian.org/security/2022/dsa-5035https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.tenable.com/security/tns-2022-01https://www.tenable.com/security/tns-2022-03
2021-12-20
Published