CVE-2021-44224

—

CVSS 3.1

8.2 high

EPSS

82%p100

Published

Dec 20, 2021 (Dec 20, 2021)

Modified

Jun 17, 2026

Description

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

Vendors: apache fedoraproject debian tenable oracle apple
Products: http server, fedora, debian linux, tenable.sc, communications element manager, communications operations monitor, communications session report manager, communications session route manager, instantis enterprisetrack, mac os x, macos
Weakness: CWE-476
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

NVD CVE.org GitHub PoCs EPSS (82.3%)

In the news2 stories

CISA, FBI and NSA Publish Joint Advisory and Scanner for Log4j Vulnerabilities

The Hacker NewsDec 29, 03:34 UTC · Dec 29, 2021Vulnerability CVE-2021-45046 CVE-2021-45105 CVE-2021-44228+2 CVEs

Apache fixed a couple of severe vulnerabilities in Apache HTTP Server

Security AffairsDec 27, 18:26 UTC · Dec 27, 2021Vulnerability CVE-2021-44790 CVE-2021-44224 CVE-2021-40438