CVE-2021-42013: Apache HTTP Server 2.4.50 Incomplete-Fix Bypass

Source-specific exposure conditions

• The deployed product is Apache HTTP Server version 2.4.49 or 2.4.50.
• The server accepts attacker-controlled HTTP requests.
• Files outside the relevant Alias-like directories are not protected by the usual default authorization rule requiring access denial.
• CGI scripts are enabled for the affected aliased paths; this condition is specifically associated with potential remote code execution.

Source-specific remediation

• Upgrade Apache HTTP Server to version 2.4.51 or later, preferably the latest vendor-supported release available for the operating system or distribution.
• For downstream or bundled products such as Oracle or NetApp offerings, follow the respective vendor advisory and verify that the bundled Apache component has been updated.
• Until upgrade, review Alias-like mappings, access-control rules, and CGI enablement; ensure sensitive files are denied by the applicable authorization policy and avoid enabling CGI on aliased paths unless required.

Source-specific verification

• Use approved asset or package inventory to identify the deployed Apache HTTP Server version without sending exploit requests.
• Confirm the reported version is not 2.4.49 or 2.4.50 and is at least 2.4.51, or confirm that the product vendor documents an equivalent backported fix.
• Review the effective configuration for Alias-like mappings, authorization rules protecting files outside those mappings, and CGI enablement on aliased paths.
• Confirm remediation through change-management or package records and, where applicable, the downstream vendor’s security bulletin.

Uncertainty and evidence gaps

• The supplied record lists downstream Oracle, Fedora, and NetApp CPEs, but those product-specific fixes and backport versions were not independently established from the returned authoritative sources.
• A version number alone may not prove that a distribution backport is present; vendor package metadata or an advisory is needed for downstream builds.
• No active exploit or production-path probing should be used as a verification method.

Claim-to-source evidence

• Affected Product: Apache HTTP Server is affected by CVE-2021-42013. Evidence
• Affected Version: The Apache project identifies Apache HTTP Server 2.4.49 and 2.4.50 as affected, and states that earlier versions are not affected by this CVE. Evidence
• Exposure: The issue can map URLs to files outside directories configured by Alias-like directives; exploitation can succeed when those files are not protected by the usual default authorization rule requiring access denial. CGI enabled for aliased paths can permit remote code execution. Evidence
• Fixed Version: Apache HTTP Server 2.4.51 is listed as the release fixing CVE-2021-42013. Evidence
• Remediation: The Apache project recommends upgrading to a release containing the fix; the fix was applied in the 2.4.x development line and released as Apache HTTP Server 2.4.51. Evidence
• Verification: A safe version-based verification can compare approved inventory of the deployed Apache HTTP Server against the affected versions 2.4.49 and 2.4.50 and the fixed release 2.4.51. Evidence

Synthesis sources

• httpd.apache.org
• nvd.nist.gov

Generation provenance

Model

gpt-5.6-luna

Generated

2026-07-22T04:30:17Z

Prompt version

2026-07-14.2

Specificity

specific

Source fingerprint

3e1ea7ea8ebbc3940c1722f68540d0a29dad3e8469e49824001a6b9f30fe6a8e

Recorded gaps

• generic_ecosystem