CVE-2021-44790

Published: Dec 20, 2021Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

Affected (35)

Products: Apache: Http Server · Fedoraproject: Fedora · Debian: Debian Linux · +4 more

Show all products

1 product

1 product

1 product

1 product

1 product

7 products

Communications Element Manager

Communications Operations Monitor

Communications Session Report Manager

Communications Session Route Manager

Http Server

Instantis Enterprisetrack

Zfs Storage Appliance Kit

Apple

2 products

Mac Os X

Macos

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	Before 2.4.52

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 34
Fedoraproject Fedora	Version 35
Fedoraproject Fedora	Version 36

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Tenable Tenable.sc	From 5.16.0 to 5.20.0

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Cloud Backup	All versions

Configuration F

12 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Element Manager	Up to 9.0
Oracle Communications Operations Monitor	Version 4.3
Oracle Communications Operations Monitor	Version 4.4
Oracle Communications Operations Monitor	Version 5.0
Oracle Communications Session Report Manager	Up to 9.0
Oracle Communications Session Route Manager	Up to 9.0
Oracle Http Server	Version 12.2.1.3.0
Oracle Http Server	Version 12.2.1.4.0
Oracle Instantis Enterprisetrack	Version 17.1
Oracle Instantis Enterprisetrack	Version 17.2
Oracle Instantis Enterprisetrack	Version 17.3
Oracle Zfs Storage Appliance Kit	Version 8.8

Configuration G

15 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	Version 10.15.7 security_update_2020-001
Apple Mac Os X	Version 10.15.7 security_update_2021-001
Apple Mac Os X	Version 10.15.7 security_update_2021-002
Apple Mac Os X	Version 10.15.7 security_update_2021-003
Apple Mac Os X	Version 10.15.7 security_update_2021-004
Apple Mac Os X	Version 10.15.7 security_update_2021-005
Apple Mac Os X	Version 10.15.7 security_update_2021-006
Apple Mac Os X	Version 10.15.7 security_update_2021-007
Apple Mac Os X	Version 10.15.7 security_update_2021-008
Apple Mac Os X	Version 10.15.7 security_update_2022-001
Apple Mac Os X	Version 10.15.7 security_update_2022-002
Apple Mac Os X	Version 10.15.7 security_update_2022-003
Apple Macos	Before 10.15.7
Apple Macos	From 11.0 to 11.6.6
Apple Macos	From 12.0 to 12.4

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (40)

http://httpd.apache.org/security/vulnerabilities_24.html

Source: security@apache.org

Vendor Advisory

http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html

Source: security@apache.org

Exploit

http://seclists.org/fulldisclosure/2022/May/33

Source: security@apache.org

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/May/35

Source: security@apache.org

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/May/38

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/12/20/4

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/

Source: security@apache.org

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/

Source: security@apache.org

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/

Source: security@apache.org

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/

Source: security@apache.org

Third Party Advisory

https://security.gentoo.org/glsa/202208-20

Source: security@apache.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20211224-0001/

Source: security@apache.org

Third Party Advisory

https://support.apple.com/kb/HT213255

Source: security@apache.org

Third Party Advisory

https://support.apple.com/kb/HT213256

Source: security@apache.org

Third Party Advisory

https://support.apple.com/kb/HT213257

Source: security@apache.org

Third Party Advisory

https://www.debian.org/security/2022/dsa-5035

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.tenable.com/security/tns-2022-01

Source: security@apache.org

Third Party Advisory

https://www.tenable.com/security/tns-2022-03

Source: security@apache.org

Third Party Advisory

http://httpd.apache.org/security/vulnerabilities_24.html