CVE-2021-44790: Apache HTTP Server

Critical severity, CVSS 9.8. EPSS: 96.8% chance of exploitation in the next 30 days.

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

Affected products

• Apache HTTP Server: before 2.4.52 (fixed in 2.4.52)
• Apple Mac OS X: version 10.15.7 only
• Apple macOS: before 10.15.7 (fixed in 10.15.7); from 11.0, before 11.6.6 (fixed in 11.6.6); from 12.0, before 12.4 (fixed in 12.4)
• Debian Debian Linux: version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 34 only; version 35 only; version 36 only
• Netapp Cloud Backup: affected versions not specified
• Oracle Communications Element Manager: up to and including 9.0
• Oracle Communications Operations Monitor: version 4.3 only; version 4.4 only; version 5.0 only
• Oracle Communications Session Report Manager: up to and including 9.0
• Oracle Communications Session Route Manager: up to and including 9.0
• Oracle HTTP Server: version 12.2.1.3.0 only; version 12.2.1.4.0 only
• Oracle Instantis Enterprisetrack: version 17.1 only; version 17.2 only; version 17.3 only
• Oracle ZFS Storage Appliance Kit: version 8.8 only
• Tenable Tenable.sc: from 5.16.0, before 5.20.0 (fixed in 5.20.0)

Published 2021-12-20. Last modified 2026-06-17.