CVE-2021-41973: apache software foundation apache mina Infinite Loop
CVSS: 6.5v3.1MediumModified
AliasesUBUNTU-CVE-2021-41973DEBIAN-CVE-2021-41973CGA-ch87-cjff-9vj2CGA-hg54-cmcg-mxj8GHSA-6mcm-j9cj-3vc3
Published 01-11-2021Last modified 04-08-2024
Vulnerability summary
CVE-2021-41973 is a medium (CVSS 6.5) Infinite Loop vulnerability in apache software foundation apache mina. EPSS estimates a 4.63% chance of exploitation in the next 30 days, higher than 91.6% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
4.63%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 01-11-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
CVSS metrics
6 scores · 5 sources · 2 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
4.63%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 4.63% on 18-09-2026
18-09-202618-10-2026
EPSS score4.63%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Oracle8 products
- banking_payments14.5
- banking_trade_finance_process_management14.5
- banking_treasury_management14.5
- communications_cloud_native_core_console1.9.0
- customer_management_and_segmentation_foundation18.0 | 19.0
Ubuntu2 products
- minaAll versions (No fix recorded)
- mina2All versions (No fix recorded)
Apache1 product
- mina< 2.0.22 | ≥ 2.1.0, < 2.1.5
Apache software foundation1 product
- apache mina≥ Apache MINA, < 2.1.5
Chainguard1 product
- hadoop-fips-3.3.6All versions (No fix recorded)
Debian1 product
- mina2< 2.1.5-1
Org.apache.mina1 product
- mina-core≥ 2.1.0, < 2.1.5 | < 2.0.22
7 vendors · 15 products
References
9 links- www.openwall.com/lists/oss-security/2021/11/01/2Mailing ListX Refsource MLISTFIXWEBPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2021/11/01/8Mailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
