CVE-2021-36160: Apache HTTP Server DoS Vulnerability

CVE-2021-36160 Overview

CVE-2021-36160 is an out-of-bounds read vulnerability in the Apache HTTP Server's mod_proxy_uwsgi module. A carefully crafted request URI path can cause the module to read beyond allocated memory boundaries, resulting in a server crash and denial of service condition. This vulnerability affects Apache HTTP Server versions 2.4.30 through 2.4.48 (inclusive).

The flaw resides in how mod_proxy_uwsgi processes incoming request URI paths when proxying requests to uWSGI backend servers. When exploited, an attacker can send specially crafted HTTP requests that trigger the out-of-bounds memory read, causing the Apache worker process to crash.

Critical Impact
Remote attackers can crash Apache HTTP Server instances by sending malicious requests, causing service disruption for web applications relying on mod_proxy_uwsgi proxy functionality.

Affected Products

Apache HTTP Server versions 2.4.30 to 2.4.48
Fedora 34 and Fedora 35
Debian Linux 9.0, 10.0, and 11.0
NetApp Cloud Backup, Clustered Data ONTAP, and StorageGRID
Oracle HTTP Server 12.2.1.3.0 and 12.2.1.4.0
Oracle Enterprise Manager Base Platform 13.4.0.0 and 13.5.0.0
Oracle PeopleSoft Enterprise PeopleTools 8.58
Broadcom Brocade Fabric Operating System Firmware

Discovery Timeline

September 16, 2021 - CVE-2021-36160 published to NVD
May 1, 2025 - Last updated in NVD database

Technical Details for CVE-2021-36160

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read). The mod_proxy_uwsgi module fails to properly validate the boundaries of request URI paths before processing them. When the module parses a maliciously crafted URI path, it can read memory outside the allocated buffer, leading to process termination.

The vulnerability can be exploited remotely over the network without requiring authentication or user interaction. While the attack does not allow data exfiltration or code execution, it effectively enables attackers to disrupt service availability by repeatedly crashing Apache worker processes.

Organizations using Apache HTTP Server with mod_proxy_uwsgi enabled to proxy requests to Python uWSGI application servers are particularly at risk. This includes common deployment scenarios for Django, Flask, and other Python web frameworks.

Root Cause

The root cause is improper boundary checking in the mod_proxy_uwsgi module when handling URI path parsing. The module does not adequately validate that memory access operations remain within the bounds of allocated buffers when processing request URIs. This allows specially crafted input to cause the server to read beyond the allocated memory region, triggering a crash.

Attack Vector

The attack vector is network-based, requiring only the ability to send HTTP requests to a vulnerable Apache HTTP Server with mod_proxy_uwsgi enabled. An attacker crafts a malicious HTTP request with a specially constructed URI path designed to trigger the out-of-bounds read condition.

The attack can be executed remotely without authentication. When the vulnerable Apache server receives and processes the malicious request through the mod_proxy_uwsgi module, the out-of-bounds memory access occurs, causing the worker process to crash. Repeated exploitation can lead to sustained denial of service.

Detection Methods for CVE-2021-36160

Indicators of Compromise

Unexpected Apache HTTP Server worker process crashes or restarts in logs
Presence of unusual or malformed URI paths in access logs targeting uWSGI proxy endpoints
Increased segmentation fault errors in system logs correlating with web requests
Anomalous patterns of requests to mod_proxy_uwsgi configured locations

Detection Strategies

Monitor Apache error logs for segmentation faults and worker process terminations
Implement web application firewall rules to detect and block malformed URI patterns
Deploy intrusion detection signatures for anomalous HTTP request patterns targeting proxy endpoints
Enable Apache's debug logging temporarily to capture detailed request information during suspected attacks

Monitoring Recommendations

Configure alerting for Apache worker process crash events and automatic restart patterns
Monitor system logs for SIGSEGV signals associated with Apache processes
Track service availability metrics for applications served through mod_proxy_uwsgi
Review access logs periodically for suspicious request patterns to proxied endpoints

How to Mitigate CVE-2021-36160

Immediate Actions Required

Upgrade Apache HTTP Server to version 2.4.49 or later immediately
If immediate patching is not possible, disable mod_proxy_uwsgi if not required for operations
Implement rate limiting on endpoints configured with mod_proxy_uwsgi to reduce attack impact
Deploy web application firewall rules to filter malicious URI patterns

Patch Information

Apache Software Foundation addressed this vulnerability in Apache HTTP Server version 2.4.49. Organizations should upgrade to this version or later to remediate CVE-2021-36160. Patches are also available through distribution-specific security updates:

Debian: Security advisory DSA-4982
Fedora: Updated packages available via Fedora Package Announcements
NetApp: Security Advisory NTAP-20211008-0004
Oracle: Addressed in January 2022 and April 2022 Critical Patch Updates

For detailed patch information, refer to the Apache HTTP Server Security Vulnerabilities page.

Workarounds

Disable mod_proxy_uwsgi by commenting out or removing the LoadModule proxy_uwsgi_module directive if the module is not required
Implement strict input validation at the network perimeter using a reverse proxy or WAF
Use alternative proxy modules such as mod_proxy_http with appropriate uWSGI HTTP protocol configuration
Restrict access to uWSGI proxy endpoints to trusted IP ranges only

bash

# Disable mod_proxy_uwsgi in Apache configuration
# Comment out or remove this line in httpd.conf or mods-enabled/
# LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so

# Alternative: Restrict access to uWSGI endpoints
<Location "/uwsgi-endpoint">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>