Skip to content
Fencer Vulns
critical 9.8

CVE-2021-20325 json

Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a securi…

published 2022-02-18 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-7748

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 75%
public exploits
0
none known

Summary

Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression compared to the versions shipped in Red Hat Enterprise Linux 8.4. A user who installs or updates to Red Hat Enterprise Linux 8.5.0 would be vulnerable to the mentioned CVEs, even if they were properly fixed in Red Hat Enterprise Linux 8.4. CVE-2021-20325 was assigned to that Red Hat specific security regression and it does not affect the upstream versions of httpd.

Patch / fix

  • httpd RHEL 8 2.4.37-43.module+el8.5.0+13064+c4b14997
  • mod_md RHEL 8 1:2.0.8-8.module+el8.3.0+6814+67d1e611
  • mod_ssl RHEL 8 1:2.4.37-43.module+el8.5.0+13064+c4b14997
  • mod_ldap RHEL 8 2.4.37-43.module+el8.5.0+13064+c4b14997
  • mod_http2 RHEL 8 1.15.7-3.module+el8.4.0+8625+d397f3da
  • httpd-tools RHEL 8 2.4.37-43.module+el8.5.0+13064+c4b14997
  • mod_session RHEL 8 2.4.37-43.module+el8.5.0+13064+c4b14997
  • httpd-manual RHEL 8 2.4.37-43.module+el8.5.0+13064+c4b14997

red hat advisories RHSA-2021:4537

  • httpd AlmaLinux 8 2.4.37-43.module_el8.5.0+2597+c4b14997.alma
  • mod_md AlmaLinux 8 1:2.0.8-8.module_el8.5.0+2609+b30d9eec
  • mod_md AlmaLinux 8 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa
  • mod_ssl AlmaLinux 8 1:2.4.37-43.module_el8.5.0+2597+c4b14997.alma
  • mod_ldap AlmaLinux 8 2.4.37-43.module_el8.5.0+2597+c4b14997.alma
  • mod_http2 AlmaLinux 8 1.15.7-3.module_el8.5.0+2609+b30d9eec
  • httpd-tools AlmaLinux 8 2.4.37-43.module_el8.5.0+2597+c4b14997.alma
  • mod_session AlmaLinux 8 2.4.37-43.module_el8.5.0+2597+c4b14997.alma

almalinux advisories ALSA-2021:4537

  • httpd Rocky Linux 8 2.4.37-43.module+el8.5.0+714+5ec56ee8
  • mod_md Rocky Linux 8 1:2.0.8-8.module+el8.5.0+695+1fa8055e
  • mod_md Rocky Linux 8 1:2.0.8-8.module+el8.4.0+553+7a69454b
  • mod_http2 Rocky Linux 8 1.15.7-3.module+el8.4.0+553+7a69454b
  • mod_http2 Rocky Linux 8 1.15.7-3.module+el8.5.0+695+1fa8055e

rocky linux advisories RLSA-2021:4537

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-20325 updated cvss 9.0

httpd: Regression of CVE-2021-40438 and CVE-2021-26691 fixes in Red Hat Enterprise Linux 8.5

  • Red Hat Enterprise Linux AppStream (v. 8) mod_md 2.0.8-8.module+el8.3.0+6814+67d1e611, httpd 2.4.37-43.module+el8.5.0+13064+c4b14997, mod_http2 1.15.7-3.module+el8.4.0+8625+d397f3da, mod_ssl 2.4.37-43.module+el8.5.0+13064+c4b14997, mod_ldap 2.4.37-43.module+el8.5.0+13064+c4b14997, httpd-tools 2.4.37-43.module+el8.5.0+13064+c4b14997, +4 more
    fixed: vendor fix RHSA-2021:4537
  • Red Hat Enterprise Linux 6 httpd, mod_ssl, httpd-tools, httpd-manual Red Hat Enterprise Linux 7 httpd, mod_ssl, mod_ldap, httpd-tools, mod_session, httpd-manual, +1 more Red Hat Enterprise Linux 9 httpd, mod_lua, mod_ssl, mod_ldap, httpd-core, httpd-tools, +4 more Red Hat JBoss Core Services jbcs-httpd24-httpd jbcs-httpd24-httpd Red Hat Software Collections httpd24-httpd, httpd24-mod_md, httpd24-mod_ssl, httpd24-mod_ldap, httpd24-httpd-tools, httpd24-mod_session, +2 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.59% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • n/a httpd

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-787 Out-of-bounds Write
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.