You are viewing a plain text version of this content. The canonical link for it is here.

Posted to announce@httpd.apache.org by Christophe JAILLET <ja...@apache.org> on 2021/06/09 21:11:00 UTC

CVE-2021-30641: Unexpected URL matching with 'MergeSlashes OFF'

CVE-2021-30641: Unexpected URL matching with 'MergeSlashes OFF'

Severity: moderate

Vendor: The Apache Software Foundation

Versions Affected:
httpd 2.4.39 to 2.4.46

Description:
Apache HTTP Server 2.4.39 to 2.4.46
Unexpected matching behavior with 'MergeSlashes OFF'
    
Mitigation:
n/a

Credit:
Discovered by Christoph Anton Mitterer

References:
https://httpd.apache.org/security/vulnerabilities_24.html