CVE-2021-39275

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.49

Description The ap escape quotes() function contains a flaw where it may write beyond the end of a buffer when processing malicious input. While no included modules pass untrusted data to this function, third-party or external modules may do so. This could allow a remote attacker to access confidential data, compromise data integrity, or cause a denial of service.

Recommendations Update to version 2.4.49 or later. Restrict the use of third-party modules that pass untrusted data to the ap escape quotes() function.