CVE-2021-44790
published 2021-12-20CVE-2021-44790: A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is…
PriorityP180critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
97.11%
99.9th percentile
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | < 2.4.52 | 2.4.52 |
| apache | httpd | — | — |
| apache_software_foundation | apache_http_server | Apache HTTP Server 2.4 – 2.4.51 | — |
| apple | mac_os_x | — | — |
| apple | macos | < 10.15.7 | 10.15.7 |
| apple | macos | >= 11.0 < 11.6.6 | 11.6.6 |
| apple | macos | >= 12.0 < 12.4 | 12.4 |
| apple | macos_big_sur | — | — |
| apple | macos_monterey | — | — |
| apple | security_update_2022-004_catalina | — | — |
| debian | apache2 | < apache2 2.4.52-1 (bookworm) | apache2 2.4.52-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cbl2_httpd_2.4.52-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_httpd_2.4.52-1_on_cbl_mariner_1.0 | — | — |
| oracle | communications_element_manager | <= 9.0 | — |
| oracle | communications_operations_monitor | — | — |
| oracle | communications_operations_monitor | — | — |
| oracle | communications_operations_monitor | — | — |
| oracle | communications_session_report_manager | <= 9.0 | — |
| oracle | communications_session_route_manager | <= 9.0 | — |
| oracle | http_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandPOST /<lua_script>.lua HTTP/1.1
Content-Type: multipart/form-data; boundary=4
4
Content-Disposition: form-data; name="name"
0
4
↗
- →Detect POST requests to .lua endpoints with a multipart/form-data Content-Type header containing a malformed/oversized boundary-delimited body that triggers 'memory allocation error: block too big' in the response. ↗
- →Alert on Apache HTTP Server versions 2.4.51 and earlier receiving multipart POST requests to Lua script endpoints, as these are the affected versions for CVE-2021-44790. ↗
- →Monitor for Apache error log entries containing 'memory allocation error: block too big' as a runtime indicator of exploitation attempts against mod_lua multipart parser. ↗
- ·The vulnerability is only exploitable when mod_lua is loaded and a Lua script explicitly calls r:parsebody() to process multipart request bodies. Servers not using mod_lua or not invoking r:parsebody() are not affected. ↗
- ·No known working exploit existed at the time of disclosure, though researchers noted one might be craftable. Detection should be treated as indicative rather than confirmatory of successful exploitation. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_apache9.8HIGH
vendor_debian9.8CRITICAL
vendor_msrc9.8CRITICAL
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu8.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-02-14·CVSS 9.8
CVE-2017-18342 [CRITICAL] PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2017-18342, CVE-2017-8923, CVE-2017-9120, CVE-2019-1551, CVE-2019-16865, CVE-2019-16905, CVE-2019-19523, CVE-2019-19528, CVE-2019-19911, CVE-2020-0404, CVE-2020-0431, CVE-2020-0466, CVE-2020-10379, CVE-2020-11538, CVE-2020-11608, CVE-2020-12114, CVE-2020-12321, CVE-2020-12362, CVE-2020-12363, CVE-2020-12364, CVE-2020-13757, CVE-2020-14314, CVE-2020-14351, CVE-2020-15778, CVE-2020-1967, CVE-2020-24394, CVE-2020-24504, CVE-2020-25211, CVE-2020-25212, CVE-2020-25284, CVE-2020-25285, CVE-2020-25717, CVE-2020-26541, CVE-2020-2715
Oracle
Oracle Oracle Communications Risk Matrix: Management (Apache HTTP Server) — CVE-2021-44790
vendor_oracle·2022-10-15·CVSS 9.8
CVE-2021-44790 [CRITICAL] Oracle Oracle Communications Risk Matrix: Management (Apache HTTP Server) — CVE-2021-44790
Oracle Oracle Communications Risk Matrix: Management (Apache HTTP Server) vulnerability
CVE: CVE-2021-44790
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2022 (OCT 2022)
Apple
CVE-2021-44790: macOS Big Sur 11.6.6
vendor_apple·2022-05-16·CVSS 9.8
CVE-2021-44790 [CRITICAL] CVE-2021-44790: macOS Big Sur 11.6.6
Apple Security Update: About the security content of macOS Big Sur 11.6.6
Product: macOS Big Sur
Version: 11.6.6
CVE: CVE-2021-44790
Component: CVE-2021-44790
Apple
CVE-2021-44790: Security Update 2022-004 Catalina
vendor_apple·2022-05-16·CVSS 9.8
CVE-2021-44790 [CRITICAL] CVE-2021-44790: Security Update 2022-004 Catalina
Apple Security Update: About the security content of Security Update 2022-004 Catalina
Product: Security Update 2022-004 Catalina
CVE: CVE-2021-44790
Component: CVE-2021-44790
Apple
CVE-2021-44790: macOS Monterey 12.4
vendor_apple·2022-05-16·CVSS 9.8
CVE-2021-44790 [CRITICAL] CVE-2021-44790: macOS Monterey 12.4
Apple Security Update: About the security content of macOS Monterey 12.4
Product: macOS Monterey
Version: 12.4
CVE: CVE-2021-44790
Component: CVE-2021-44790
CISA ICS
Mitsubishi Electric MELSOFT iQ AppPortal
cisa_ics·2022-05-12·CVSS 5.5
[MEDIUM] Mitsubishi Electric MELSOFT iQ AppPortal
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Mitsubishi Electric MELSOFT iQ AppPortal
Last RevisedMay 12, 2022
Alert CodeICSA-22-132-02
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Mitsubishi Electric
- Equipment: MELSOFT iQ AppPortal
- Vulnerabilities: Missing Authorization, Out-of-bounds Write, NULL Pointer Dereference, Classic Buffer Overflow, HTTP Request Smuggling, Infinite Loop
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in a denial-of-service condition, malicious program execution, information disclosure, informa
Oracle
Oracle Oracle Communications Risk Matrix: Security (Apache HTTP Server) — CVE-2021-44790
vendor_oracle·2022-04-15·CVSS 9.8
CVE-2021-44790 [CRITICAL] Oracle Oracle Communications Risk Matrix: Security (Apache HTTP Server) — CVE-2021-44790
Oracle Oracle Communications Risk Matrix: Security (Apache HTTP Server) vulnerability
CVE: CVE-2021-44790
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Oracle
Oracle Oracle Construction and Engineering Risk Matrix: Core (Apache HTTP Server) — CVE-2021-44790
vendor_oracle·2022-01-15·CVSS 9.8
CVE-2021-44790 [CRITICAL] Oracle Oracle Construction and Engineering Risk Matrix: Core (Apache HTTP Server) — CVE-2021-44790
Oracle Oracle Construction and Engineering Risk Matrix: Core (Apache HTTP Server) vulnerability
CVE: CVE-2021-44790
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2022 (JAN 2022)
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2022-01-10·CVSS 8.2
CVE-2021-44790 [HIGH] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
USN-5212-1 fixed several vulnerabilities in Apache. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that the Apache HTTP Server incorrectly handled certain
forward proxy requests. A remote attacker could use this issue to cause
the server to crash, resulting in a denial of service, or possibly perform
a Server Side Request Forgery attack. (CVE-2021-44224)
It was discovered that the Apache HTTP Server Lua module incorrectly
handled memory in the multipart parser. A remote attacker could use this
issue to cause the server to crash, resulting in a denial of service, or
possibly execute arbitrary
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2022-01-06·CVSS 8.2
CVE-2021-44790 [HIGH] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
It was discovered that the Apache HTTP Server incorrectly handled certain
forward proxy requests. A remote attacker could use this issue to cause
the server to crash, resulting in a denial of service, or possibly perform
a Server Side Request Forgery attack. (CVE-2021-44224)
It was discovered that the Apache HTTP Server Lua module incorrectly
handled memory in the multipart parser. A remote attacker could use this
issue to cause the server to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2021-44790)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
httpd: mod_lua: Possible buffer overflow when parsing multipart content
vendor_redhat·2021-12-20·CVSS 9.8
CVE-2021-44790 [CRITICAL] CWE-787 httpd: mod_lua: Possible buffer overflow when parsing multipart content
httpd: mod_lua: Possible buffer overflow when parsing multipart content
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
A buffer overflow flaw in httpd's lua module could allow an out-of-bounds write. An attacker who is able to submit a crafted request to an httpd instance that is using the lua module may be able to cause an impact to confidentiality, integrity, and/or availability.
Statement: httpd as shipped in Red Hat Enterprise Linux 6 is NOT affected by this flaw because it does not ship mod_lua.
Mitigation: Disabling mod_lua and
Microsoft
Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier
vendor_msrc·2021-12-14·CVSS 9.8
CVE-2021-44790 [CRITICAL] CWE-787 Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier
Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
apache: apache
Customer Action Required: Yes
Remed
Debian
CVE-2021-44790: apache2 - A carefully crafted request body can cause a buffer overflow in the mod_lua mult...
vendor_debian·2021·CVSS 9.8
CVE-2021-44790 [CRITICAL] CVE-2021-44790: apache2 - A carefully crafted request body can cause a buffer overflow in the mod_lua mult...
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
Scope: local
bookworm: resolved (fixed in 2.4.52-1)
bullseye: resolved (fixed in 2.4.52-1~deb11u2)
forky: resolved (fixed in 2.4.52-1)
sid: resolved (fixed in 2.4.52-1)
trixie: resolved (fixed in 2.4.52-1)
Apache
Apache httpd: CVE-2021-44790
vendor_apache·CVSS 9.8
CVE-2021-44790 [HIGH] Apache httpd: CVE-2021-44790
Apache httpd: CVE-2021-44790
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier. Acknowledgements: Chamal Reported to security team 2021-12-07 Fixed by r1896039 in 2.4.x 2021-12-16 Update 2.4.52 released 2021-12-20 Affects <=2.4.51
Severity: high
GHSA
GHSA-c547-2659-q37g: A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts)
ghsa_unreviewed·2022-02-08
CVE-2021-44790 [CRITICAL] CWE-787 GHSA-c547-2659-q37g: A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts)
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
OSV
apache2 vulnerabilities
osv·2022-01-10·CVSS 8.2
CVE-2021-44224 [HIGH] apache2 vulnerabilities
apache2 vulnerabilities
USN-5212-1 fixed several vulnerabilities in Apache. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that the Apache HTTP Server incorrectly handled certain
forward proxy requests. A remote attacker could use this issue to cause
the server to crash, resulting in a denial of service, or possibly perform
a Server Side Request Forgery attack. (CVE-2021-44224)
It was discovered that the Apache HTTP Server Lua module incorrectly
handled memory in the multipart parser. A remote attacker could use this
issue to cause the server to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2021-44790)
OSV
apache2 vulnerabilities
osv·2022-01-06·CVSS 8.2
CVE-2021-44224 [HIGH] apache2 vulnerabilities
apache2 vulnerabilities
It was discovered that the Apache HTTP Server incorrectly handled certain
forward proxy requests. A remote attacker could use this issue to cause
the server to crash, resulting in a denial of service, or possibly perform
a Server Side Request Forgery attack. (CVE-2021-44224)
It was discovered that the Apache HTTP Server Lua module incorrectly
handled memory in the multipart parser. A remote attacker could use this
issue to cause the server to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2021-44790)
OSV
CVE-2021-44790: A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts)
osv·2021-12-20·CVSS 9.8
CVE-2021-44790 [CRITICAL] CVE-2021-44790: A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts)
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
No detection rules found.
Bugzilla
CVE-2021-44790 httpd: mod_lua: Possible buffer overflow when parsing multipart content
bugzilla·2021-12-21·CVSS 9.8
CVE-2021-44790 [CRITICAL] CVE-2021-44790 httpd: mod_lua: Possible buffer overflow when parsing multipart content
CVE-2021-44790 httpd: mod_lua: Possible buffer overflow when parsing multipart content
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
References:
http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
Discussion:
Created httpd tracking bugs for this issue:
Affects: fedora-all [bug 2034675]
---
Likely upstream patch: https://svn.apache.org/viewvc?view=revision&revision=1896039
---
This vulnerability is out of security support scope for the following product:
* Red Hat JBos
Tenable
Oracle April 2022 Critical Patch Update Addresses 221 CVEs
blogs_tenable·2022-04-20
Oracle April 2022 Critical Patch Update Addresses 221 CVEs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
http://httpd.apache.org/security/vulnerabilities_24.htmlhttp://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.htmlhttp://seclists.org/fulldisclosure/2022/May/33http://seclists.org/fulldisclosure/2022/May/35http://seclists.org/fulldisclosure/2022/May/38http://www.openwall.com/lists/oss-security/2021/12/20/4https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/https://security.gentoo.org/glsa/202208-20https://security.netapp.com/advisory/ntap-20211224-0001/https://support.apple.com/kb/HT213255https://support.apple.com/kb/HT213256https://support.apple.com/kb/HT213257https://www.debian.org/security/2022/dsa-5035https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.tenable.com/security/tns-2022-01https://www.tenable.com/security/tns-2022-03http://httpd.apache.org/security/vulnerabilities_24.htmlhttp://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.htmlhttp://seclists.org/fulldisclosure/2022/May/33http://seclists.org/fulldisclosure/2022/May/35http://seclists.org/fulldisclosure/2022/May/38http://www.openwall.com/lists/oss-security/2021/12/20/4https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/https://security.gentoo.org/glsa/202208-20https://security.netapp.com/advisory/ntap-20211224-0001/https://support.apple.com/kb/HT213255https://support.apple.com/kb/HT213256https://support.apple.com/kb/HT213257https://www.debian.org/security/2022/dsa-5035https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.tenable.com/security/tns-2022-01https://www.tenable.com/security/tns-2022-03
2021-12-20
Published