What’s Vulnerable › Vulnerabilities

CVE-2021-44790: Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 96.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-12-20 · updated 2026-06-17
• Weakness: CWE-787

Description

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

Affected products

• Apache HTTP Server: before 2.4.52 — fixed in 2.4.52
• macOS: 10.15.7-security_update_2020-001, 10.15.7-security_update_2021-001, 10.15.7-security_update_2021-002, 10.15.7-security_update_2021-003, 10.15.7-security_update_2021-004, 10.15.7-security_update_2021-005 (+6)
• Apple macOS: before 10.15.7; from 11.0 before 11.6.6; from 12.0 before 12.4 — fixed in 10.15.7, 11.6.6, 12.4
• Debian Linux: 10.0, 11.0
• Fedoraproject Fedora: 34, 35, 36
• NetApp Cloud Backup: all versions
• Oracle Communications Element Manager: through 9.0
• Oracle Corporation Communications Operations Monitor: 4.3, 4.4, 5.0
• Oracle Communications Session Report Manager: through 9.0
• Oracle Communications Session Route Manager: through 9.0
• Oracle Corporation Oracle HTTP Server: 12.2.1.3.0, 12.2.1.4.0
• Oracle Instantis Enterprisetrack: 17.1, 17.2, 17.3
• Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8
• Tenable.sc: from 5.16.0 before 5.20.0 — fixed in 5.20.0

How to fix

Upgrade to a fixed version: Apache HTTP Server 2.4.52; Apple macOS 10.15.7, 11.6.6, 12.4; Tenable.sc 5.20.0. Check the vendor advisory for mitigations.

References

• http://httpd.apache.org/security/vulnerabilities_24.html
• http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html
• http://seclists.org/fulldisclosure/2022/May/33
• http://seclists.org/fulldisclosure/2022/May/35
• http://seclists.org/fulldisclosure/2022/May/38
• http://www.openwall.com/lists/oss-security/2021/12/20/4
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/
• https://security.gentoo.org/glsa/202208-20
• https://security.netapp.com/advisory/ntap-20211224-0001/

Get alerted when CVE-2021-44790 or the next vulnerability affects your stack