{"id":"CVE-2021-44790","url":"https://www.cyber-defence.io/tools/cve/CVE-2021-44790","generatedAt":"2026-11-05T00:48:32.025Z","title":"A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts).","description":"A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.","published":"2021-12-20T12:15:07.000Z","lastModified":"2026-06-17T04:12:51.000Z","status":"Analyzed","sourceIdentifier":"security@apache.org","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-787"],"affected":["apache/http server","fedoraproject/fedora","debian/debian linux","tenable/tenable.sc","netapp/cloud backup","oracle/communications element manager","oracle/communications operations monitor","oracle/communications session report manager","oracle/communications session route manager","oracle/http server","oracle/instantis enterprisetrack","oracle/zfs storage appliance kit","apple/mac os x","apple/macos"],"epss":{"score":0.9684,"percentile":0.99888,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":true,"firstPublished":"2023-04-01","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":51193,"kind":"exploit","title":"Apache 2.4.x - Buffer Overflow","url":"https://www.exploit-db.com/exploits/51193","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/51193.py","file":"exploits/multiple/webapps/51193.py","published":"2023-04-01","added":"2023-04-01","updated":"2023-06-07","author":"Sunil Iyengar","type":"webapps","platform":"multiple","port":null,"verified":true,"codes":["CVE-2021-44790"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 96.8%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://httpd.apache.org/security/vulnerabilities_24.html","tags":["Vendor Advisory"],"source":"security@apache.org"},{"url":"http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","tags":["Exploit"],"source":"security@apache.org"},{"url":"http://seclists.org/fulldisclosure/2022/May/33","tags":["Mailing List","Third Party Advisory"],"source":"security@apache.org"},{"url":"http://seclists.org/fulldisclosure/2022/May/35","tags":["Mailing List","Third Party Advisory"],"source":"security@apache.org"},{"url":"http://seclists.org/fulldisclosure/2022/May/38","tags":["Mailing List","Third Party Advisory"],"source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2021/12/20/4","tags":["Mailing List","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://security.gentoo.org/glsa/202208-20","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://security.netapp.com/advisory/ntap-20211224-0001/","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://support.apple.com/kb/HT213255","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://support.apple.com/kb/HT213256","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://support.apple.com/kb/HT213257","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.debian.org/security/2022/dsa-5035","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["Patch","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.tenable.com/security/tns-2022-01","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.tenable.com/security/tns-2022-03","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"http://httpd.apache.org/security/vulnerabilities_24.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","tags":["Exploit"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2022/May/33","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2022/May/35","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2022/May/38","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2021/12/20/4","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202208-20","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20211224-0001/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT213255","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT213256","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT213257","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2022/dsa-5035","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.tenable.com/security/tns-2022-01","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.tenable.com/security/tns-2022-03","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-44790","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}