CVEvulnerability

CVE-2021-44790

9.8 CRITICAL Published 2021-12-20 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2021-12-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-787

Description

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

Affected configurations

• apache http server (< 2.4.52) • fedoraproject fedora 34 • fedoraproject fedora 35 • fedoraproject fedora 36 • debian debian linux 10.0 • debian debian linux 11.0 • tenable tenable.sc (>= 5.16.0 < 5.20.0) • netapp cloud backup • oracle communications element manager (<= 9.0) • oracle communications operations monitor 4.3 • oracle communications operations monitor 4.4 • oracle communications operations monitor 5.0 • oracle communications session report manager (<= 9.0) • oracle communications session route manager (<= 9.0) • oracle http server 12.2.1.3.0 • oracle http server 12.2.1.4.0 • oracle instantis enterprisetrack 17.1 • oracle instantis enterprisetrack 17.2 • oracle instantis enterprisetrack 17.3 • oracle zfs storage appliance kit 8.8 • apple mac os x 10.15.7 • apple macos (< 10.15.7) • apple macos (>= 11.0 < 11.6.6) • apple macos (>= 12.0 < 12.4)

Related

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References