Description

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache HTTP Server	>= Apache HTTP Server 2.4, <= 2.4.51

References

http://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.htmlExploit
http://seclists.org/fulldisclosure/2022/May/33Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2022/May/35Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2022/May/38Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/20/4Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/Third Party Advisory
https://security.gentoo.org/glsa/202208-20Third Party Advisory
https://security.netapp.com/advisory/ntap-20211224-0001/Third Party Advisory
https://support.apple.com/kb/HT213255Third Party Advisory
https://support.apple.com/kb/HT213256Third Party Advisory
https://support.apple.com/kb/HT213257Third Party Advisory
https://www.debian.org/security/2022/dsa-5035Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
https://www.tenable.com/security/tns-2022-01Third Party Advisory
https://www.tenable.com/security/tns-2022-03Third Party Advisory
http://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.htmlExploit
http://seclists.org/fulldisclosure/2022/May/33Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2022/May/35Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2022/May/38Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/20/4Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/Third Party Advisory
https://security.gentoo.org/glsa/202208-20Third Party Advisory
https://security.netapp.com/advisory/ntap-20211224-0001/Third Party Advisory
https://support.apple.com/kb/HT213255Third Party Advisory
https://support.apple.com/kb/HT213256Third Party Advisory
https://support.apple.com/kb/HT213257Third Party Advisory
https://www.debian.org/security/2022/dsa-5035Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
https://www.tenable.com/security/tns-2022-01Third Party Advisory
https://www.tenable.com/security/tns-2022-03Third Party Advisory

Timeline

Published: Dec 20, 2021
Last modified: Jun 17, 2026
NVD status: Analyzed

CVE-2021-44790