CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HCVE-2021-41973
Medium (6.5). EPSS 4.6% chance of exploitation in the next 30 days. Fixed in org.apache.mina:mina-core 2.0.22, 2.1.5.
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
Severity
- EPSS
- 4.6% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
- CWE
- CWE-835
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:mina
- oracle:banking_payments
- oracle:banking_trade_finance_process_management
- oracle:banking_treasury_management
- oracle:communications_cloud_native_core_console
- oracle:customer_management_and_segmentation_foundation
- oracle:flexcube_universal_banking
- oracle:fusion_middleware_common_libraries_and_tools
- oracle:oss_support_tools
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6mcm-j9cj-3vc3 | Maven | org.apache.mina:mina-core | >=2.1.0 <2.1.5 | 2.1.5 |
| GHSA-6mcm-j9cj-3vc3 | Maven | org.apache.mina:mina-core | <2.0.22 | 2.0.22 |
References
- http://www.openwall.com/lists/oss-security/2021/11/01/2
- http://www.openwall.com/lists/oss-security/2021/11/01/8
- https://lists.apache.org/thread.html/r0b907da9340d5ff4e6c1a4798ef4e79700a668657f27cca8a39e9250%40%3Cdev.mina.apache.org%3E
- https://www.oracle.com/security-alerts/cpuapr2022.html
- http://www.openwall.com/lists/oss-security/2021/11/01/2