Medium severity · published Nov 1, 2021
CVE-2021-41973
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely
6.5
CVSS
4.6%
EPSS
No
On KEV
Description
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.6% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BP
Banking Payments · Oracle
14.5 · source: NVD
BT
Banking Trade Finance Process Management · Oracle
14.5 · source: NVD
BT
Banking Treasury Management · Oracle
14.5 · source: NVD
CC
Communications Cloud Native Core Console · Oracle
1.9.0 · source: NVD
CM
Customer Management And Segmentation Foundation · Oracle
18.0; 19.0 · source: NVD
FU
Flexcube Universal Banking · Oracle
14.0 through 14.3; 14.5 · source: NVD
FM
Fusion Middleware Common Libraries And Tools · Oracle
12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 · source: NVD
MI
Mina · Apache
before 2.0.22; 2.1.0 before 2.1.5 · source: NVD
OS
Oss Support Tools · Oracle
2.12.42 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-41973
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-41973
Mailing List
http://www.openwall.com/lists/oss-security/2021/11/01/2
Mailing List
http://www.openwall.com/lists/oss-security/2021/11/01/8
Mailing List
https://lists.apache.org/thread.html/r0b907da9340d5ff4e6c1a4798ef4e79700a668657f27cca8a39e9250%40%3Cdev.mina.apache.org%3E
Patch
https://www.oracle.com/security-alerts/cpuapr2022.html
More from Mina
9.8
CVE-2026-47065
Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232
9.8
CVE-2026-42778
Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)
9.8
CVE-2026-42779
Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)
9.8
CVE-2026-41409
Apache MINA: CWE-502 Deserialization of Untrusted Data
9.8
CVE-2026-41635
Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE