CVE-2021-26691: Apache HTTP Server mod_session response handling heap overflow

Q: What is CVE-2021-26691?

CVE-2021-26691 is a heap overflow vulnerability in Apache httpd mod_session.

Q: How does CVE-2021-26691 affect Apache HTTP Server?

CVE-2021-26691 affects Apache HTTP Server versions 2.4.0 to 2.4.46 and can cause a heap overflow when a specially crafted SessionHeader is sent by an origin server.

Q: What is the severity of CVE-2021-26691?

CVE-2021-26691 has a severity rating of 9.8 (Critical).

Q: How can I fix CVE-2021-26691?

To fix CVE-2021-26691, update your Apache HTTP Server to version 2.4.47 or higher.

Q: Where can I find more information about CVE-2021-26691?

You can find more information about CVE-2021-26691 at the following references: [GitHub](https://github.com/apache/httpd/commit/7e09dd714fc62c08c5b0319ed7b9702594faf49b), [Red Hat Security Policy](https://access.redhat.com/support/policy/updates/jboss_notes), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1969233).

Published Jun 1, 2021

Updated

A heap overflow flaw was found In Apache httpd modsession. The highest threat from this vulnerability is to system availability.

Other sources

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

In Apache httpd before 2.4.48 modsession has a heap overflow.

References:

https://github.com/apache/httpd/commit/7e09dd714fc62c08c5b0319ed7b9702594faf49b

— Red Hat

Affected Software

30 affected componentsFixes available

redhat/jbcs-httpd24-apr<0:1.6.3-107.el8

0:1.6.3-107.el8

redhat/jbcs-httpd24-apr-util<0:1.6.1-84.el8

0:1.6.1-84.el8

redhat/jbcs-httpd24-curl<0:7.78.0-2.el8

0:7.78.0-2.el8

redhat/jbcs-httpd24-httpd<0:2.4.37-78.el8

0:2.4.37-78.el8

redhat/jbcs-httpd24-nghttp2<0:1.39.2-39.el8

0:1.39.2-39.el8

redhat/jbcs-httpd24-openssl<1:1.1.1g-8.el8

1:1.1.1g-8.el8

redhat/jbcs-httpd24-openssl-chil<0:1.0.0-7.el8

0:1.0.0-7.el8

redhat/jbcs-httpd24-openssl-pkcs11<0:0.4.10-22.el8

0:0.4.10-22.el8

redhat/jbcs-httpd24-apr<0:1.6.3-107.jbcs.el7

0:1.6.3-107.jbcs.el7

redhat/jbcs-httpd24-apr-util<0:1.6.1-84.jbcs.el7

0:1.6.1-84.jbcs.el7

redhat/jbcs-httpd24-curl<0:7.78.0-2.jbcs.el7

0:7.78.0-2.jbcs.el7

redhat/jbcs-httpd24-httpd<0:2.4.37-78.jbcs.el7

0:2.4.37-78.jbcs.el7

redhat/jbcs-httpd24-nghttp2<0:1.39.2-39.jbcs.el7

0:1.39.2-39.jbcs.el7

redhat/jbcs-httpd24-openssl<1:1.1.1g-8.jbcs.el7

1:1.1.1g-8.jbcs.el7

redhat/jbcs-httpd24-openssl-chil<0:1.0.0-7.jbcs.el7

0:1.0.0-7.jbcs.el7

redhat/jbcs-httpd24-openssl-pkcs11<0:0.4.10-22.jbcs.el7

0:0.4.10-22.jbcs.el7

redhat/httpd<0:2.4.6-97.el7_9.4

0:2.4.6-97.el7_9.4

Apache HTTP Server>=2.4.0<=2.4.46

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Fedoraproject Fedora=34

Fedoraproject Fedora=35

Oracle Enterprise Manager Ops Center=12.4.0.0

Oracle Instantis Enterprisetrack=17.1

Oracle Instantis Enterprisetrack=17.2

Oracle Instantis Enterprisetrack=17.3

Oracle Secure Backup<18.1.0.1.0

Oracle ZFS Storage Appliance Kit=8.8

NetApp Cloud Backup

redhat/httpd<2.4.47

2.4.47

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/jbcs-httpd24-apr to a version that resolves this vulnerability.
Fixed in 0:1.6.3-107.el8
Upgrade
Upgrade redhat/jbcs-httpd24-apr-util to a version that resolves this vulnerability.
Fixed in 0:1.6.1-84.el8
Upgrade
Upgrade redhat/jbcs-httpd24-curl to a version that resolves this vulnerability.
Fixed in 0:7.78.0-2.el8
Upgrade
Upgrade redhat/jbcs-httpd24-httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.37-78.el8
Upgrade
Upgrade redhat/jbcs-httpd24-nghttp2 to a version that resolves this vulnerability.
Fixed in 0:1.39.2-39.el8
Upgrade
Upgrade redhat/jbcs-httpd24-openssl to a version that resolves this vulnerability.
Fixed in 1:1.1.1g-8.el8
Upgrade
Upgrade redhat/jbcs-httpd24-openssl-chil to a version that resolves this vulnerability.
Fixed in 0:1.0.0-7.el8
Upgrade
Upgrade redhat/jbcs-httpd24-openssl-pkcs11 to a version that resolves this vulnerability.
Fixed in 0:0.4.10-22.el8
Upgrade
Upgrade redhat/jbcs-httpd24-apr to a version that resolves this vulnerability.
Fixed in 0:1.6.3-107.jbcs.el7
Upgrade
Upgrade redhat/jbcs-httpd24-apr-util to a version that resolves this vulnerability.
Fixed in 0:1.6.1-84.jbcs.el7
Upgrade
Upgrade redhat/jbcs-httpd24-curl to a version that resolves this vulnerability.
Fixed in 0:7.78.0-2.jbcs.el7
Upgrade
Upgrade redhat/jbcs-httpd24-httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.37-78.jbcs.el7
Upgrade
Upgrade redhat/jbcs-httpd24-nghttp2 to a version that resolves this vulnerability.
Fixed in 0:1.39.2-39.jbcs.el7
Upgrade
Upgrade redhat/jbcs-httpd24-openssl to a version that resolves this vulnerability.
Fixed in 1:1.1.1g-8.jbcs.el7
Upgrade
Upgrade redhat/jbcs-httpd24-openssl-chil to a version that resolves this vulnerability.
Fixed in 0:1.0.0-7.jbcs.el7
Upgrade
Upgrade redhat/jbcs-httpd24-openssl-pkcs11 to a version that resolves this vulnerability.
Fixed in 0:0.4.10-22.jbcs.el7
Upgrade
Upgrade redhat/httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.6-97.el7_9.4
Upgrade
Upgrade redhat/httpd to a version that resolves this vulnerability.
Fixed in 2.4.47
Upgrade
Upgrade Apache httpd to a version that resolves this vulnerability.
Fixed in 2.4.48

Event History

Jun 1, 2021

Data Sourced

via Red Hat·06:37 PM

DescriptionSeverityAffected Software

Jun 4, 2021

CVE Published

12:00 AM

Jun 10, 2021

CVE Published

via MITRE·07:10 AM

Data Sourced

via MITRE·07:10 AM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2021-26691?