CVE-2021-41524

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

• CWE-476
• CWE-476

• http://www.openwall.com/lists/oss-security/2021/10/05/1Mailing List, Third Party Advisory
• https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
• https://security.gentoo.org/glsa/202208-20Third Party Advisory
• https://security.netapp.com/advisory/ntap-20211029-0009/Third Party Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZThird Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/10/05/1Mailing List, Third Party Advisory
• https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
• https://security.gentoo.org/glsa/202208-20Third Party Advisory
• https://security.netapp.com/advisory/ntap-20211029-0009/Third Party Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZThird Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory

Published

Oct 5, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41500Incomplete string comparison vulnerability exits in cvxopt.o…7.5
• CVE-2021-41502An issue was discovered in Subrion CMS v4.2.1 There is a sto…5.4
• CVE-2021-41503DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by…8
• CVE-2021-41504An Elevated Privileges issue exists in D-Link DCS-5000L v1.0…8
• CVE-2021-41506Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7…9.8
• CVE-2021-41511The username and password field of login in Lodging Reservat…9.8
• CVE-2021-41525An issue related to modification of otherwise restricted fil…5.5
• CVE-2021-41526A vulnerability has been reported in the windows installer (…7.8
• CVE-2021-41527An error related to the 2-factor authorization (2FA) on the …2.3
• CVE-2021-41528An error when handling authorization related to the import /…5.3
• CVE-2021-41530Forcepoint NGFW Engine versions 6.5.11 and earlier, 6.8.6 an…7.5
• CVE-2021-41531NLnet Labs Routinator prior to 0.10.0 produces invalid RTR p…7.5