CVE-2021-36160: Apache HTTP Server mod_proxy_uwsgi out-of-bounds read causes crash

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 with network reachability and no authentication required, plus a very high EPSS percentile, though impact is limited to denial of service and no KEV listing exists.

What it is

A crafted request URI path causes mod_proxy_uwsgi in Apache HTTP Server to read past the end of allocated memory, resulting in a crash. The flaw is an out-of-bounds read (CWE-125) affecting versions 2.4.30 through 2.4.48. It matters because any deployment exposing the uwsgi proxy module can be taken down by a single malformed request.

Impact

An unauthenticated remote attacker can crash the affected Apache HTTP Server process, causing a denial of service. The out-of-bounds read is not described as leading to code execution or data disclosure.

Attack surface

Reachable over the network via HTTP requests to a server that has mod_proxy_uwsgi enabled and configured to proxy to a uwsgi backend. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV and no ransomware association is documented. EPSS is high (0.62887, 99.16th percentile), and references are limited to vendor advisories and patch notices, so no public exploit code is confirmed by this record.

What to do

• Upgrade Apache HTTP Server to a version later than 2.4.48 that contains the fix, or apply the vendor patch referenced in the Apache advisory.
• If mod_proxy_uwsgi is not needed, disable or remove the module to eliminate the attack surface.
• Apply distribution vendor updates (Debian, Fedora, Gentoo) and downstream vendor patches (NetApp, Oracle, Cisco/Broadcom) for bundled Apache components.
• Restrict network access to Apache instances running mod_proxy_uwsgi where feasible, and monitor for repeated crashes.
• Verify the module is not loaded in default or unused configurations after upgrading.

Detection

• Monitor Apache error logs for crashes, segfaults or abnormal child process termination correlated with proxy_uwsgi requests.
• Inspect access logs for unusual or malformed URI paths directed at uwsgi-proxied locations.
• Track process restart frequency for httpd workers as an indicator of repeated denial-of-service attempts.
• Alert on known scanning or exploit attempts against Apache HTTP Server 2.4.30-2.4.48 endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.