critical
CVE-2021-39275
httpd: Out-of-bounds write in ap_escape_quotes() via malicious input
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Bitnami, CBL-Mariner, Photon OS. Rated lower by Amazon (high), Oracle (high), Red Hat (medium), AlmaLinux (medium), Rocky Linux (medium), Ubuntu (medium).
Description
ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | apache | 2.4.49 |
| CBL-Mariner 1.0 | httpd | 0:2.4.49-1.cm1 |
| CBL-Mariner 2.0 | httpd | 0:2.4.52-1.cm2 |
| Photon OS 1.0 | httpd | 2.4.48-4.ph1 |
| Photon OS 2.0 | httpd | 2.4.48-4.ph2 |
| Photon OS 3.0 | httpd | 2.4.48-4.ph3 |
| alma 8 | httpd:2.4::httpd, httpd:2.4::httpd-devel, httpd:2.4::httpd-filesystem and 7 more | 2.4.37-43.module_el8.5.0+2630+51c6d843.2.alma and 2 more |
| alpine 3.11 | apache2 | 2.4.49-r0 |
| alpine 3.12 | apache2 | 2.4.49-r0 |
| alpine 3.13 | apache2 | 2.4.49-r0 |
| alpine 3.14 | apache2 | 2.4.49-r0 |
| alpine 3.15 | apache2 | 2.4.49-r0 |
Show all 105 entries from 46 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | apache | 2.4.49 |
| CBL-Mariner 1.0 | httpd | 0:2.4.49-1.cm1 |
| CBL-Mariner 2.0 | httpd | 0:2.4.52-1.cm2 |
| Photon OS 1.0 | httpd | 2.4.48-4.ph1 |
| Photon OS 2.0 | httpd | 2.4.48-4.ph2 |
| Photon OS 3.0 | httpd | 2.4.48-4.ph3 |
| alma 8 | httpd:2.4::httpd | 2.4.37-43.module_el8.5.0+2630+51c6d843.2.alma |
| alma 8 | httpd:2.4::httpd-devel | 2.4.37-43.module_el8.5.0+2630+51c6d843.2.alma |
| alma 8 | httpd:2.4::httpd-filesystem | 2.4.37-43.module_el8.5.0+2630+51c6d843.2.alma |
| alma 8 | httpd:2.4::httpd-manual | 2.4.37-43.module_el8.5.0+2630+51c6d843.2.alma |
| alma 8 | httpd:2.4::httpd-tools | 2.4.37-43.module_el8.5.0+2630+51c6d843.2.alma |
| alma 8 | httpd:2.4::mod_ldap | 2.4.37-43.module_el8.5.0+2630+51c6d843.2.alma |
| alma 8 | httpd:2.4::mod_md | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa |
| alma 8 | httpd:2.4::mod_proxy_html | 1:2.4.37-43.module_el8.5.0+2630+51c6d843.2.alma |
| alma 8 | httpd:2.4::mod_session | 2.4.37-43.module_el8.5.0+2630+51c6d843.2.alma |
| alma 8 | httpd:2.4::mod_ssl | 1:2.4.37-43.module_el8.5.0+2630+51c6d843.2.alma |
| alpine 3.11 | apache2 | 2.4.49-r0 |
| alpine 3.12 | apache2 | 2.4.49-r0 |
| alpine 3.13 | apache2 | 2.4.49-r0 |
| alpine 3.14 | apache2 | 2.4.49-r0 |
| alpine 3.15 | apache2 | 2.4.49-r0 |
| alpine 3.16 | apache2 | 2.4.49-r0 |
| alpine 3.17 | apache2 | 2.4.49-r0 |
| alpine 3.18 | apache2 | 2.4.49-r0 |
| alpine 3.19 | apache2 | 2.4.49-r0 |
| alpine 3.20 | apache2 | 2.4.49-r0 |
| alpine 3.21 | apache2 | 2.4.49-r0 |
| alpine 3.22 | apache2 | 2.4.49-r0 |
| alpine 3.23 | apache2 | 2.4.49-r0 |
| alpine 3.24 | apache2 | 2.4.49-r0 |
| alpine edge | apache2 | 2.4.49-r0 |
| amazon linux 1 | httpd24 | 2.4.51-1.94.amzn1 |
| amazon linux 1 | httpd24-debuginfo | 2.4.51-1.94.amzn1 |
| amazon linux 1 | httpd24-devel | 2.4.51-1.94.amzn1 |
| amazon linux 1 | httpd24-manual | 2.4.51-1.94.amzn1 |
| amazon linux 1 | httpd24-tools | 2.4.51-1.94.amzn1 |
| amazon linux 1 | mod24_ldap | 2.4.51-1.94.amzn1 |
| amazon linux 1 | mod24_md | 2.4.51-1.94.amzn1 |
| amazon linux 1 | mod24_proxy_html | 1:2.4.51-1.94.amzn1 |
| amazon linux 1 | mod24_session | 2.4.51-1.94.amzn1 |
| amazon linux 1 | mod24_ssl | 1:2.4.51-1.94.amzn1 |
| amazon linux 2 | httpd | 2.4.51-1.amzn2 |
| amazon linux 2 | httpd-debuginfo | 2.4.51-1.amzn2 |
| amazon linux 2 | httpd-devel | 2.4.51-1.amzn2 |
| amazon linux 2 | httpd-filesystem | 2.4.51-1.amzn2 |
| amazon linux 2 | httpd-manual | 2.4.51-1.amzn2 |
| amazon linux 2 | httpd-tools | 2.4.51-1.amzn2 |
| amazon linux 2 | mod_ldap | 2.4.51-1.amzn2 |
| amazon linux 2 | mod_md | 2.4.51-1.amzn2 |
| amazon linux 2 | mod_proxy_html | 1:2.4.51-1.amzn2 |
| amazon linux 2 | mod_session | 2.4.51-1.amzn2 |
| amazon linux 2 | mod_ssl | 1:2.4.51-1.amzn2 |
| debian 10 | apache2 | 2.4.38-3+deb10u6 |
| debian 11 | apache2 | 2.4.51-1~deb11u1 |
| debian 12 | apache2 | 2.4.49-1 |
| debian 13 | apache2 | 2.4.49-1 |
| debian 14 | apache2 | 2.4.49-1 |
| debian 9 | apache2 | 2.4.25-3+deb9u11 |
| echo | apache2 | 2.4.49-1 |
| Oracle Linux 7 | httpd | 2.4.6-97.0.5.el7_9.4 |
| Oracle Linux 7 | httpd-devel | 2.4.6-97.0.5.el7_9.4 |
| Oracle Linux 7 | httpd-manual | 2.4.6-97.0.5.el7_9.4 |
| Oracle Linux 7 | httpd-tools | 2.4.6-97.0.5.el7_9.4 |
| Oracle Linux 7 | mod_ldap | 2.4.6-97.0.5.el7_9.4 |
| Oracle Linux 7 | mod_proxy_html | 1:2.4.6-97.0.5.el7_9.4 |
| Oracle Linux 7 | mod_session | 2.4.6-97.0.5.el7_9.4 |
| Oracle Linux 7 | mod_ssl | 1:2.4.6-97.0.5.el7_9.4 |
| Oracle Linux 8 | httpd | 2.4.37-43.0.2.module+el8.5.0+20518+d9453e37.2 |
| Oracle Linux 8 | httpd-devel | 2.4.37-43.0.2.module+el8.5.0+20518+d9453e37.2 |
| Oracle Linux 8 | httpd-filesystem | 2.4.37-43.0.2.module+el8.5.0+20518+d9453e37.2 |
| Oracle Linux 8 | httpd-manual | 2.4.37-43.0.2.module+el8.5.0+20518+d9453e37.2 |
| Oracle Linux 8 | httpd-tools | 2.4.37-43.0.2.module+el8.5.0+20518+d9453e37.2 |
| Oracle Linux 8 | mod_http2 | 1.15.7-3.module+el8.4.0+20024+b87b2deb |
| Oracle Linux 8 | mod_ldap | 2.4.37-43.0.2.module+el8.5.0+20518+d9453e37.2 |
| Oracle Linux 8 | mod_md | 1:2.0.8-8.module+el8.5.0+20475+4f6a8fd5 |
| Oracle Linux 8 | mod_proxy_html | 1:2.4.37-43.0.2.module+el8.5.0+20518+d9453e37.2 |
| Oracle Linux 8 | mod_session | 2.4.37-43.0.2.module+el8.5.0+20518+d9453e37.2 |
| Oracle Linux 8 | mod_ssl | 1:2.4.37-43.0.2.module+el8.5.0+20518+d9453e37.2 |
| Red Hat | httpd | no fix listed |
| Red Hat | httpd-devel | no fix listed |
| Red Hat | httpd-manual | no fix listed |
| Red Hat | httpd-tools | no fix listed |
| Red Hat | mod_ssl | no fix listed |
| rocky 8 | httpd:2.4::httpd | 2.4.37-43.module+el8.5.0+714+5ec56ee8 |
| rocky 8 | httpd:2.4::httpd-devel | 2.4.37-43.module+el8.5.0+714+5ec56ee8 |
| rocky 8 | httpd:2.4::httpd-filesystem | 2.4.37-43.module+el8.5.0+714+5ec56ee8 |
| rocky 8 | httpd:2.4::httpd-manual | 2.4.37-43.module+el8.5.0+714+5ec56ee8 |
| rocky 8 | httpd:2.4::httpd-tools | 2.4.37-43.module+el8.5.0+714+5ec56ee8 |
| rocky 8 | httpd:2.4::mod_http2 | 1.15.7-3.module+el8.5.0+695+1fa8055e |
| rocky 8 | httpd:2.4::mod_ldap | 2.4.37-43.module+el8.5.0+714+5ec56ee8 |
| rocky 8 | httpd:2.4::mod_md | 1:2.0.8-8.module+el8.5.0+695+1fa8055e |
| rocky 8 | httpd:2.4::mod_proxy_html | 1:2.4.37-43.module+el8.5.0+714+5ec56ee8 |
| rocky 8 | httpd:2.4::mod_session | 2.4.37-43.module+el8.5.0+714+5ec56ee8 |
| rocky 8 | httpd:2.4::mod_ssl | 1:2.4.37-43.module+el8.5.0+714+5ec56ee8 |
| root.io debian 12 | rootio-apache2 | 2.4.49-1 |
| root.io debian 13 | rootio-apache2 | 2.4.49-1 |
| ubuntu 14.04-ESM | apache2 | 2.4.7-1ubuntu4.22+esm2 |
| ubuntu 16.04-ESM | apache2 | 2.4.18-2ubuntu3.17+esm2 |
| ubuntu 18.04 | apache2 | 2.4.29-1ubuntu4.17 |
| ubuntu 18.04-ESM | apache2 | 2.4.29-1ubuntu4.17 |
| ubuntu 20.04 | apache2 | 2.4.41-4ubuntu3.5 |
| ubuntu 20.04-ESM | apache2 | 2.4.41-4ubuntu3.5 |
| ubuntu 21.04 | apache2 | 2.4.46-4ubuntu1.2 |
| ubuntu 21.10 | apache2 | 2.4.48-3.1ubuntu2 |
| ubuntu 22.04 | apache2 | 2.4.48-3.1ubuntu2 |
References
- https://access.redhat.com/security/cve/CVE-2021-39275
- https://bugzilla.redhat.com/show_bug.cgi?id=2005119
- https://bugzilla.redhat.com/show_bug.cgi?id=2005128
- https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275
- https://errata.almalinux.org/8/ALSA-2022-0891.html
- https://errata.rockylinux.org/RLSA-2022:0891
All 29 references
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-39275
- https://linux.oracle.com/cve/CVE-2021-39275.html
- https://linux.oracle.com/errata/ELSA-2022-9005.html
- https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
- https://nvd.nist.gov/vuln/detail/CVE-2021-39275
- https://security.gentoo.org/glsa/202208-20
- https://security.netapp.com/advisory/ntap-20211008-0004/
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
- https://ubuntu.com/security/notices/USN-5090-1
- https://ubuntu.com/security/notices/USN-5090-2
- https://www.cve.org/CVERecord?id=CVE-2021-39275
- https://www.debian.org/security/2021/dsa-4982
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html