SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityAnalyzed

CVE-2021-44790

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts).

CRITICAL 9.8EPSS 96.8%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 96.8%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

CVSS 3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
96.84% probability · 100th percentile
CISA KEV
Not listed
Weakness
CWE-787
Affected
apache/http server · fedoraproject/fedora · debian/debian linux · tenable/tenable.sc · netapp/cloud backup · oracle/communications element manager · oracle/communications operations monitor · oracle/communications session report manager · oracle/communications session route manager · oracle/http server · oracle/instantis enterprisetrack · oracle/zfs storage appliance kit · apple/mac os x · apple/macos
Source
security@apache.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.