CVE-2021-41773

CVE-2021-41773 is a critical-severity vulnerability in Apache Http Server with a CVSS 3.x base score of 9.8. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2021-11-03). The underlying weakness is classified as CWE-22.

Key facts

Description

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

CVE-2021-41773: Apache HTTP Server 2.4.49 Path Traversal and Remote Code Execution

AI-generated analysis based on the vulnerability data on this page.

Attribute Value
CVE CVE-2021-41773
CWE CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
CVSS v3.1 9.8 (Critical)
CVSS v2 4.3 (Medium)
EPSS 0.99992
KEV Yes (added 2021-11-03)
Affected Product Apache HTTP Server 2.4.49

Summary

A flaw in path normalization in Apache HTTP Server 2.4.49 allows attackers to perform path traversal attacks, mapping URLs to files outside directories configured by Alias-like directives. When CGI scripts are enabled for these aliased paths, this can lead to remote code execution. This vulnerability is known to be exploited in the wild.

Background

Apache HTTP Server is one of the most widely deployed web servers. Version 2.4.49 introduced a change to path normalization that inadvertently allowed attackers to bypass path traversal protections using encoded sequences. This vulnerability represents a significant regression in a mature codebase.

Root Cause

The vulnerability is classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). The root cause lies in a change made to path normalization logic in Apache HTTP Server 2.4.49. Specifically, the normalization failed to properly decode and validate path sequences, allowing attackers to traverse out of configured document roots using specially crafted URL paths. This bypasses the intended sandboxing provided by Alias-like directives.

Impact

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores this vulnerability at 9.8 (Critical). The metrics indicate:

  • Attack Vector: Network — exploitable remotely without local access
  • Attack Complexity: Low — no special conditions required
  • Privileges Required: None — no authentication needed
  • User Interaction: None — fully automated exploitation possible
  • Scope: Unchanged — impact remains within the vulnerable component
  • Confidentiality, Integrity, Availability: High — all three pillars are compromised, especially when CGI execution is enabled

The CVSS v2 score of 4.3 reflects a more conservative assessment, but the CVSS v3.1 score of 9.8 accurately captures the full impact when remote code execution is achievable.

Exploitation Walkthrough

⚠️ Ethics & Legal Notice: The following description is provided for defensive purposes only. Attempting to exploit systems without explicit authorization is illegal and unethical.

An attacker sends a crafted HTTP request containing path traversal sequences to an Apache HTTP Server 2.4.49 instance. If the server uses Alias-like directives to map URLs to specific directories, the crafted request can escape those boundaries and access files elsewhere on the filesystem. When CGI handlers are configured for the aliased path, the attacker may cause the server to execute arbitrary scripts, leading to remote code execution.

Defenders should verify that:

  • Files outside aliased directories are protected by Require all denied or equivalent directives
  • CGI execution is disabled where not strictly necessary
  • URL paths are validated at upstream layers (WAF, reverse proxy)

Affected and Patched Versions

Affected:

  • Apache HTTP Server 2.4.49

Also Affected (as bundled/distributed):

  • Fedora 34, Fedora 35
  • Oracle Instantis EnterpriseTrack 17.1, 17.2, 17.3
  • NetApp Cloud Backup

Patched Versions:

  • Apache HTTP Server 2.4.50 and later (note: the initial 2.4.50 fix was incomplete; the fully resolved version is 2.4.51 or later)
  • openSUSE Tumbleweed: apache2 ≥ 2.4.51-1.1

Remediation

  1. Upgrade: Update Apache HTTP Server to version 2.4.51 or later. The 2.4.50 release contained a partial fix that was later superseded by 2.4.51 (see CVE-2021-42013).
  2. Compensating Controls: If immediate patching is not feasible:
    • Ensure all directories outside intended web roots explicitly deny access using Require all denied
    • Disable CGI execution (mod_cgi, mod_cgid) on aliased paths where not required
    • Deploy a Web Application Firewall (WAF) with rules to block path traversal sequences
    • Place Apache behind a reverse proxy that performs path validation

Detection

  • Monitor web server logs for requests containing %2e, .., or encoded path traversal sequences targeting aliased paths
  • Look for unexpected HTTP 200 responses to requests that should have been blocked by directory restrictions
  • Enable mod_security or equivalent WAF rules detecting directory traversal attempts
  • Correlate with threat intelligence feeds flagging exploitation of CVE-2021-41773

Assessment

With an EPSS score of 0.99992 (99.992% probability of exploitation in the wild) and inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog since 2021-11-03, this vulnerability poses an extreme and well-documented risk. The EU also tracks this under EUVD-2021-28781 with confirmed exploitation since the same date.

Key lessons:

  1. Path normalization is security-critical: Even minor changes to URL parsing logic in widely deployed software can have catastrophic consequences. Regression testing for path traversal must be exhaustive.
  2. Rapid patching matters: The gap between disclosure and mass exploitation was minimal. Organizations running public-facing Apache servers should have automated patching pipelines for critical web server components.

References

Frequently asked questions

What is CVE-2021-41773?
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
How severe is CVE-2021-41773?
CVE-2021-41773 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2021-41773 being actively exploited?
Yes. CVE-2021-41773 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2021-11-03, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2021-41773?
CVE-2021-41773 primarily affects Apache Http Server. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2021-41773?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2021-41773 have an EU (EUVD) identifier?
Yes. CVE-2021-41773 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2021-28781. It is also flagged as exploited in the EUVD (since 2021-11-03).
When was CVE-2021-41773 published?
CVE-2021-41773 was published on 2021-10-05 and last updated on 2026-06-17.

References

Affected products (7)

More vulnerabilities in Apache Http Server

All CVEs affecting Apache Http Server →

Other CWE-22 (Path Traversal) vulnerabilities

Browse all CWE-22 (Path Traversal) vulnerabilities →