Tag

#web-server

1 post tagged #web-server.

Analysis · May 20, 2026 · Colten Anderson

Apache HTTP Server 2.4.49: a path-traversal fix that needed a second fix

CVE-2021-41773 was a path traversal in Apache httpd 2.4.49 that could leak files and, with CGI enabled, reach RCE. The 2.4.50 fix was incomplete, so CVE-2021-42013 followed days later. Two CVEs, one bug, a textbook patch-the-patch.