CVE-2021-33193 : faille élevée debian debian linux (CVSS 7.5)

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

Sévérité

Élevée (CVSS 7.5)

Vecteur CVSS

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitation active

Non signalée par la CISA

Publication

16 août 2021

Dernière mise à jour

17 juin 2026

• debian debian linux
• apache http server
• fedoraproject fedora
• tenable tenable.sc
• oracle secure backup
• oracle zfs storage appliance kit

• Fiche CVE-2021-33193 sur le NVD (NIST)
• github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe4142…
• lists.apache.org/thread…
• lists.apache.org/thread…
• lists.debian.org/debian-lts-announce/2023/03/msg00002.html
• lists.fedoraproject.org/archives/list/package…
• lists.fedoraproject.org/archives/list/package…
• portswigger.net/research/http2
• security.gentoo.org/glsa/202208-20
• security.netapp.com/advisory/ntap-20210917-0004/
• tools.cisco.com/security/center/content/CiscoSecurityAdvisory/…
• oracle.com/security-alerts/cpuapr2022.html
• oracle.com/security-alerts/cpujan2022.html
• tenable.com/security/tns-2021-17