Apache MINA HTTP Header Decoder Vulnerability - CVE-2021-41973
Summary
CVE-2021-41973: In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. Affects mina2 versions < 97df92e57a15ea60282a5310df0eefa8527d2286. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache MINA is a network application framework that enables developers to create high-performance and high-scalability network applications easily. It provides a simple and flexible API for handling network protocols, making it a popular choice for building server-side applications. However, a vulnerability has been identified in its HTTP Header decoder, which can lead to potential denial of service due to infinite looping when processing malformed HTTP requests.
Vulnerability Detail
The vulnerability, identified as CVE-2021-41973, arises from the HTTP Header decoder's assumption that the header begins at the start of the buffer. When a specifically crafted malformed HTTP request is received, the decoder may enter an infinite loop, consuming server resources and potentially leading to a denial of service. This issue affects multiple versions of the 'mina' and 'mina2' packages across different Debian ecosystems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to filter out malformed HTTP requests before they reach the Apache MINA server. This can help mitigate the risk of triggering the infinite loop in the decoder.
Conclusion
The CVE-2021-41973 vulnerability in Apache MINA poses a significant risk of denial of service due to infinite looping in the HTTP Header decoder when processing malformed requests. It is crucial to update to the patched version to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for mina2 →
FAQ
CVE-2021-41973 is a vulnerability in Apache MINA that allows a malformed HTTP request to cause the HTTP Header decoder to loop indefinitely.
If your application uses Apache MINA and processes HTTP requests, it may be susceptible to denial of service attacks due to this vulnerability.
All versions prior to 2.1.5 are affected in the 'mina' and 'mina2' packages across Debian ecosystems.
Yes, updating to version 2.1.5 or greater of the 'mina' or 'mina2' package will patch this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can also check your application against this vulnerability using the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for mina2.
