CVE-2021-26691

httpd: mod_session: Heap overflow via a crafted SessionHeader value

Loading…

Severity

Moderate

Red Hat Product Security

8.1

CVSS 3.1

Review impact separately from score.

Published · June 4, 2021

Updated · September 21, 2026

Description

A heap overflow flaw was found In Apache httpd mod_session. The highest threat from this vulnerability is to system availability.

Statement

This flaw can result in a crash of the httpd child process when mod_session is used.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Only configurations which use the "SessionEnv" directive (which is not widely used) are vulnerable to this flaw. SessionEnv is not enabled in default configuration of httpd package shipped with Red Hat Products.

CVSS / CWE

CVSS 3.1 · 8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer