CVE-2021-44790

CRITICAL CVSS: 9.8 Published: 2021-12-20 Modified: 2026-06-17

Description

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

Affected Platforms

Oracle Communications Session Report ManagerOracle Instantis EnterprisetrackOracle Communications Element ManagerOracle Http ServerApache Http ServerTenable Tenable.ScFedoraproject FedoraApple Mac Os XOracle Communications Session Route ManagerDebian Debian Linux

Weakness Type

CWE-787, CWE-787

References

http://httpd.apache.org/security/vulnerabilities_24.html
http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html
http://seclists.org/fulldisclosure/2022/May/33
http://seclists.org/fulldisclosure/2022/May/35
http://seclists.org/fulldisclosure/2022/May/38
http://www.openwall.com/lists/oss-security/2021/12/20/4