Was my server affected by the Apache 2.4.49 path traversal?
Short answer: only Apache HTTP Server 2.4.49 and 2.4.50 are affected. If your server reports one of those two versions, it is potentially affected and should be updated to 2.4.51 or newer. Older and newer versions are not affected. If your server hides its Apache version, we cannot tell. Paste your address below for a free check.
This is an earlier wave. We added this page afterwards as background; it was not published when the flaw was disclosed. Last updated: 26 October 2026.
What happened
On 5 October 2021 the Apache HTTP Server project released version 2.4.50 and announced CVE-2021-41773, a flaw in Apache 2.4.49 that was already being exploited. A visitor could reach files outside the folders the server is meant to publish, if the server did not deny access to them. Where CGI scripts were enabled for those paths, they could also run commands.
The fix in 2.4.50 turned out to be incomplete. On 7 October 2021 Apache released 2.4.51 to close the gap, tracked as CVE-2021-42013. The US cybersecurity agency CISA published an alert on 6 October and later listed both flaws as exploited, including in ransomware attacks.
Only these two releases were affected. 2.4.49 had come out on 16 September 2021, less than three weeks before the flaw was announced.
Which versions are fixed
| Apache HTTP Server | Status |
|---|---|
| 2.4.48 and older | not affected |
| 2.4.49 | affected (CVE-2021-41773 and CVE-2021-42013) |
| 2.4.50 | affected (CVE-2021-42013, incomplete fix) |
| 2.4.51 and newer | fixed |
What our check can and cannot tell you
We look at your site from the outside, the way any visitor does. We read the Apache version in your server's response headers and compare it with the table above. We do not test the flaw.
- Potentially affected: your server reports 2.4.49 or 2.4.50. We say potentially because some Linux distributions fix packages without changing the version number, and because the flaw also depends on how the server is configured.
- Cannot tell: your server says it is Apache but hides the version. Ask your host, or run apachectl -v on the server.
- No sign of this problem: your server reports a version older than 2.4.49 or 2.4.51 and newer, or does not look like Apache. This is "no sign from the outside", not a guarantee.
What to do
- Find out your Apache version. Ask your host, or run apachectl -v (or httpd -v) on the server.
- Update to 2.4.51 or newer. 2.4.50 is not enough. Restart Apache after updating.
- If your server ran 2.4.49 or 2.4.50 in October 2021 or later, ask your developer or host to check for signs of a break-in.
- Run this check again after the update.
Official sources
- Apache Software Foundation: Apache HTTP Server 2.4 vulnerabilities
- CISA: Apache Releases Security Update for Apache HTTP Server (6 October 2021)
- CISA: Known Exploited Vulnerabilities catalog (both CVEs added 3 November 2021)
- Rapid7: Apache HTTP Server CVE-2021-41773 exploited in the wild
Scanylo is not affiliated with the Apache Software Foundation, CISA or Rapid7. This page is a plain-language summary, not a replacement for the advisories. This is a passive, external check and not a penetration test.
Why this page exists
This is an earlier wave, kept on the wave radar as background. We added the page afterwards; it was not published when the flaw was disclosed on 2021-10-05. Sites that never updated can still be exposed, so the check still runs.
Every time a major vulnerability wave hits the news, Scanylo publishes a check page within 24 hours. Tick the email alert box above and we will re-check your site on every new wave and tell you the result. It is free and needs no account. The check is passive: we read the version your site shows to any visitor and nothing else. Methodology.