CVE-2021-26691

Apache HTTP Server mod_session response handling heap overflow

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

We have discovered 704,185 live websites that are affected by CVE-2021-26691.

Run a Free Instant Scan



Affected Software

Product  Apache
Category Web Servers
Vulnerable Domains704,185 live websites (29% of Apache install base)
Vulnerable Versions
  • from 2.4 through 2.4
  • from 2.4.1 through 2.4.1
  • from 2.4.2 through 2.4.2
  • from 2.4.3 through 2.4.3
  • from 2.4.4 through 2.4.4
  • from 2.4.6 through 2.4.6
  • from 2.4.7 through 2.4.7
  • from 2.4.9 through 2.4.9
  • from 2.4.10 through 2.4.10
  • from 2.4.12 through 2.4.12
  • from 2.4.16 through 2.4.16
  • from 2.4.17 through 2.4.17
  • from 2.4.18 through 2.4.18
  • from 2.4.20 through 2.4.20
  • from 2.4.23 through 2.4.23
  • from 2.4.25 through 2.4.25
  • from 2.4.26 through 2.4.26
  • from 2.4.27 through 2.4.27
  • from 2.4.28 through 2.4.28
  • from 2.4.29 through 2.4.29
  • from 2.4.33 through 2.4.33
  • from 2.4.34 through 2.4.34
  • from 2.4.35 through 2.4.35
  • from 2.4.37 through 2.4.37
  • from 2.4.38 through 2.4.38
  • from 2.4.39 through 2.4.39
  • from 2.4.41 through 2.4.41
  • from 2.4.43 through 2.4.43
  • from 2.4.46 through 2.4.46
Vulnerable Versions Count29 versions ( 24% of all versions)


Common Weakness Enumeration

CWE-122 Heap-based Buffer Overflow



Details

  • Published - Jun 10, 2021
  • Updated - Aug 3, 2024

Credits

  • Discovered internally Christophe Jaillet

Website Distribution by Country

Number of websites using CVE-2021-26691
United States213,067 websites


Germany66,993 websites
France41,147 websites
Japan34,321 websites
Russia31,585 websites
Netherlands28,993 websites
Italy25,483 websites
Czech Republic20,354 websites
Poland19,596 websites
Singapore15,592 websites

Website Distribution by TLD

Number of websites using CVE-2021-26691
.com265,207 websites
.de41,148 websites
.org30,928 websites
.net28,261 websites
.ru27,611 websites
.it22,653 websites
.nl21,410 websites
.pl16,977 websites
.cz16,421 websites
.jp16,077 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2021-26691

Top websites that are affected by CVE-2021-26691. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*************.***.****.****.************.net United States***
*********.net United States***
***.****.us United States*,***
***.*********.com Singapore*,***
*****.*******.com Singapore*,***
******************.com United States*,***
*******.**.com United States*,***
****.*********.net GB*,***
****.com United States*,***
********.com United States*,***
See full domain list

FAQ

CVE-2021-26691 is Heap-based Buffer Overflow in Apache
A total of 704,185 websites have been identified as vulnerable to CVE-2021-26691, based on global website indexing conducted by WebTechSurvey.
The Apache is affected by the CVE-2021-26691 vulnerability.
Apache versions up to and including 2.4.46 are vulnerable to CVE-2021-26691.

References