mod_proxy_uwsgi out of bound read

Summary

A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).

Timeline

1. Sep 16, 2021, 2:40 PM UTCCVE published
2. Aug 4, 2024, 12:47 AM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache HTTP Server

  From Apache HTTP Server 2.4 · through 2.4.48

References 24