PerfoMetrix

All vulnerabilities · Apache

Apache HTTP Server Path Traversal (CVE-2021-41773, CVE-2021-42013): Check and Patch

CVE-2021-41773CVE-2021-42013CVSS 9.8Actively exploited (CISA KEV)

Apache 2.4.49 and 2.4.50 let attackers read files outside the web root and, with CGI enabled, run code. Check your Apache version and update to 2.4.51 or later.

Is your site affected? Check the Apache version it shows

Passive check: we load your page like a visitor would and read the versions it announces. We never send exploits or attack the site. "Not affected" or "hidden" doesn’t prove a server is safe: a firewall or proxy can hide versions, and only the server itself can confirm its packages.

Affected and fixed versions

AffectedFixed in
>=2.4.49 <=2.4.49
>=2.4.50 <=2.4.50
2.4.51

A change to path normalization in Apache HTTP Server 2.4.49 let crafted, URL-encoded paths escape the directories Apache is meant to serve (CVE-2021-41773). The fix in 2.4.50 was incomplete (CVE-2021-42013). Where files outside the web root weren’t explicitly denied, attackers could read them, and where CGI scripts were enabled (mod_cgi), they could run commands. Both are in CISA’s catalog of actively exploited vulnerabilities.

Who is affected

  • Apache HTTP Server 2.4.49 and 2.4.50 only. Earlier and later versions don’t have this bug.
  • The default Require all denied for the file system blocks the attack; servers that loosened it are exposed, and those with mod_cgi enabled can be fully taken over.

What our check looks at

We read the version in your Server header (for example Apache/2.4.49) and compare it with the affected versions. Linux distributions often keep their own version numbers and add fixes, so a distribution build (such as Apache/2.4.49 (Ubuntu)) is flagged as “may be patched” rather than affected.

How to fix it

  1. Update to Apache 2.4.51 or later (the current 2.4 release is best).
    • Debian/Ubuntu: sudo apt update && sudo apt install --only-upgrade apache2
    • RHEL/AlmaLinux/Rocky: sudo dnf upgrade httpd
  2. Keep Require all denied on <Directory />, and disable mod_cgi if you don’t use it.
  3. Hide the version: ServerTokens Prod and ServerSignature Off.

FAQ

How do I know if my server is affected?

Run apachectl -v (or httpd -v) on the server. Only 2.4.49 and 2.4.50 are affected.

We are on 2.4.48. Should we upgrade to 2.4.49?

No. Go straight to the latest 2.4 release.

Does a CDN in front of Apache protect us?

It may filter known attack strings, but the vulnerable server is still there. Update it.

Official advisory

Last updated October 27, 2026 · This product uses data from the NVD API but is not endorsed or certified by the NVD.

Monitor your site for free