CVE-2021-41973

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache MINA	>= Apache MINA, < 2.1.5

References

http://www.openwall.com/lists/oss-security/2021/11/01/2Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/11/01/8Mailing List, Third Party Advisory
https://lists.apache.org/thread.html/r0b907da9340d5ff4e6c1a4798ef4e79700a668657f27cca8a39e9250%40%3Cdev.mina.apache.org%3EMailing List, Patch, Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/11/01/2Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/11/01/8Mailing List, Third Party Advisory
https://lists.apache.org/thread.html/r0b907da9340d5ff4e6c1a4798ef4e79700a668657f27cca8a39e9250%40%3Cdev.mina.apache.org%3EMailing List, Patch, Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory

Timeline

Published: Nov 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-419749.1Tad Book3 editing book page does not perform identity verification. Remote attackers can use the vulnerability to view and modify arbitrary CVE-2021-419759.1TadTools special page is vulnerable to authorization bypass, thus remote attackers can use the specific parameter to delete arbitrary files CVE-2021-419765.3Tad Uploader edit book list function is vulnerable to authorization bypass, thus remote attackers can use the function to amend the folder n CVE-2021-41986.1A NULL Pointer Dereference vulnerability in the messaging_ipc.dll component as used in Bitdefender Total Security, Internet Security, Antivi CVE-2021-419878.1In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code CVE-2021-419887.8Qlik NPrinting Designer through 21.14.3.0 creates a Temporary File in a Directory with Insecure Permissions.CVE-2021-419897.8Qlik QlikView through 12.60.20100.0 creates a Temporary File in a Directory with Insecure Permissions.CVE-2021-41997.8Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender Tota CVE-2021-419907.5The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. For example,CVE-2021-419917.5The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certifi CVE-2021-419925.6A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA b CVE-2021-419934.8A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA by