CVE-2021-33193: Request splitting via HTTP/2 method injection and mod_proxy
A crafted method sent through HTTP/2 will bypass validation and be forwarded by modproxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.
Other sources
A NULL pointer dereference was found in Apache httpd modh2. The highest threat from this flaw is to system integrity.
Request splitting via HTTP/2 method injection and modproxy in Apache httpd before 2.4.47.
Upstream patch:
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
— Red Hat
Affected Software
Remediation
Information
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-33193?
CVE-2021-33193 is a vulnerability found in Apache httpd mod_h2 that allows a crafted method sent through HTTP/2 to bypass validation and be forwarded by mod_proxy, leading to request splitting or cache poisoning.
Which versions of Apache HTTP Server are affected by CVE-2021-33193?
The vulnerability affects Apache HTTP Server versions 2.4.17 to 2.4.48.
What is the severity of CVE-2021-33193?
CVE-2021-33193 has a severity rating of 7.5, which is considered high.
How can I fix CVE-2021-33193?
To fix CVE-2021-33193, you should update Apache HTTP Server to version 2.4.49 or newer.
Where can I find more information about CVE-2021-33193?
You can find more information about CVE-2021-33193 on the following references: [Link 1](https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch), [Link 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1996514), [Link 3](https://access.redhat.com/errata/RHSA-2022:1915)