CVE-2021-44224
HighA crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server…
Published May 17, 2022 · Updated Sep 8, 2026 · Also known as ALPINE-CVE-2021-44224, BIT-apache-2021-44224, DEBIAN-CVE-2021-44224, DLA-2907-1, DSA-5035-1, SUSE-SU-2022:0065-1, SUSE-SU-2022:0091-1, SUSE-SU-2022:0091-2, SUSE-SU-2022:0119-1, SUSE-SU-2022:0440-1, UBUNTU-CVE-2021-44224, USN-5212-1, USN-5212-2
Key Facts
Patch immediately- CVE-2021-44224 is a high-severity vulnerability (CVSS 8.2 v3.1) affecting HTTP Server (Apache), Communications Element Manager (Oracle), Communications Operations Monitor (Oracle) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 82% probability of exploitation in the next 30 days.
- Fixed versions are available, including apache 2.4.52, HTTP Server 2.4.52, HTTP Server Apache HTTP Server 2.4*.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS (30-day exploit likelihood)
82%
Higher than 99.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2021-44224 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
Affected Products
386 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| HTTP ServerApache | 12.2.1.3.0, 12.2.1.4.0, >= 2.4.7 | 2.4.52 |
| Communications Element ManagerOracle | See advisory | 9.0 |
| Communications Operations MonitorOracle | 4.0, 4.3, 4.4, 5.0 | n/a |
| Communications Session Report ManagerOracle | See advisory | 9.0 |
| Communications Session Route ManagerOracle | See advisory | 9.0 |
Patched Releases
apache
2.4.52
HTTP Server
2.4.52, Apache HTTP Server 2.4*
apache2
2.4.18-2ubuntu3.17+esm4, 2.4.23-29.83.1, 2.4.25-3+deb9u12, 2.4.29-1ubuntu4.21, 2.4.33-3.61.1, 2.4.38-3+deb10u7, 2.4.41-4ubuntu3.9, 2.4.51-3.37.1, 2.4.51-35.7.1, 2.4.52-1, 2.4.52-1.1, 2.4.52-1~deb11u2, 2.4.52-1ubuntu1, 2.4.52-r0, 2.4.66-150400.6.57.1, 2.4.7-1ubuntu4.22+esm3
apache2-devel
2.4.33-3.61.1, 2.4.51-3.37.1, 2.4.51-35.7.1, 2.4.66-150400.6.57.1
apache2-doc
2.4.23-29.83.1, 2.4.33-3.61.1, 2.4.51-3.37.1, 2.4.51-35.7.1, 2.4.66-150400.6.57.1
apache2-event
2.4.51-3.37.1
apache2-example-pages
2.4.23-29.83.1, 2.4.51-3.37.1, 2.4.51-35.7.1
apache2-prefork
2.4.23-29.83.1, 2.4.33-3.61.1, 2.4.51-3.37.1, 2.4.51-35.7.1, 2.4.66-150400.6.57.1
apache2-utils
2.4.23-29.83.1, 2.4.33-3.61.1, 2.4.51-3.37.1, 2.4.51-35.7.1, 2.4.66-150400.6.57.1
apache2-worker
2.4.23-29.83.1, 2.4.33-3.61.1, 2.4.51-3.37.1, 2.4.51-35.7.1, 2.4.66-150400.6.57.1
Macos
10.15.7
chromedriver
99.0.4844.84-bp153.2.75.1
chromium
99.0.4844.84-bp153.2.75.1
httpd
2.4.37-47.0.1.module+el8.6.0+20649+083145da.1, 2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma, 2.4.37-47.module+el8.6.0+823+f143cee1.1, 2.4.37-47.module+el8.6.0+985+b8ff6398.2, 2.4.52-1, 2.4.52-1.amzn2, 2.4.52-1.amzn2022.0.1, 2.4.54-3.amzn2022.0.3, 2.4.54-3.amzn2023.0.4, NA
httpd-core
2.4.54-3.amzn2022.0.3, 2.4.54-3.amzn2023.0.4
httpd-devel
2.4.37-47.0.1.module+el8.6.0+20649+083145da.1, 2.4.52-1.amzn2, 2.4.52-1.amzn2022.0.1, 2.4.54-3.amzn2022.0.3, 2.4.54-3.amzn2023.0.4, NA
httpd-docs
NA
httpd-filesystem
2.4.37-47.0.1.module+el8.6.0+20649+083145da.1, 2.4.52-1.amzn2, 2.4.52-1.amzn2022.0.1, 2.4.54-3.amzn2022.0.3, 2.4.54-3.amzn2023.0.4
httpd-manual
2.4.37-47.0.1.module+el8.6.0+20649+083145da.1, 2.4.52-1.amzn2, 2.4.52-1.amzn2022.0.1, 2.4.54-3.amzn2022.0.3, 2.4.54-3.amzn2023.0.4
httpd-tools
2.4.37-47.0.1.module+el8.6.0+20649+083145da.1, 2.4.52-1.amzn2, 2.4.52-1.amzn2022.0.1, 2.4.54-3.amzn2022.0.3, 2.4.54-3.amzn2023.0.4, NA
httpd:2.4
8060020220321163517.d63f516d
httpd24
2.4.52-1.95.amzn1
httpd24-devel
2.4.52-1.95.amzn1
httpd24-httpd
0:2.4.34-23.el7.5
httpd24-manual
2.4.52-1.95.amzn1
Timeline
Publicly disclosed
May 17, 2022
Last updated
Sep 8, 2026
Weakness Type
- CWE-476 NULL Pointer Dereference
- CWE-918 Server-Side Request Forgery (SSRF)
References
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
- advisoryhttp://httpd.apache.org/security/vulnerabilities_24.html
- advisoryhttps://9to5mac.com/2022/05/16/apple-patches-27-security-flaws-ios-15-5/
- advisoryRHSA-2022:1915
FAQ
Common Questions.
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery).
Affected: HTTP Server (Apache) versions 12.2.1.3.0, 12.2.1.4.0, >= 2.4.7; Communications Element Manager (Oracle); Communications Operations Monitor (Oracle) versions 4.0, 4.3, 4.4, 5.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including apache 2.4.52, HTTP Server 2.4.52, HTTP Server Apache HTTP Server 2.4*.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2021-44224 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo