Servers and applications
CVE-2021-44224
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
- Severity
- High 8.2
- Published
- 20 Dec 2021
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 17 Oct 2026
- Fixed in
- 2.4.52
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Apache HTTP ServerServers and applications · cpe:a:apache:http_server |
|