CVE-2021-44790
CRITICALCVSS 9.8/10EPSS 97.11%
Last modified
CVE-2021-44790 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. EPSS estimates a 97.11% chance of exploitation in the next 30 days.
Description
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Apache | Http Server | < 2.4.52 | — |
| Fedoraproject | Fedora | 34 | — |
| Fedoraproject | Fedora | 35 | — |
| Fedoraproject | Fedora | 36 | — |
| Debian | Debian Linux | 10.0 | — |
| Debian | Debian Linux | 11.0 | — |
| Tenable | Tenable.Sc | >= 5.16.0, < 5.20.0 | — |
| Netapp | Cloud Backup | All versions | — |
| Oracle | Communications Element Manager | <= 9.0 | — |
| Oracle | Communications Operations Monitor | 4.3 | — |
| Oracle | Communications Operations Monitor | 4.4 | — |
| Oracle | Communications Operations Monitor | 5.0 | — |
| Oracle | Communications Session Report Manager | <= 9.0 | — |
| Oracle | Communications Session Route Manager | <= 9.0 | — |
| Oracle | Http Server | 12.2.1.3.0 | — |
| Oracle | Http Server | 12.2.1.4.0 | — |
| Oracle | Instantis Enterprisetrack | 17.1 | — |
| Oracle | Instantis Enterprisetrack | 17.2 | — |
| Oracle | Instantis Enterprisetrack | 17.3 | — |
| Oracle | Zfs Storage Appliance Kit | 8.8 | — |
| Apple | Mac Os X | 10.15.7 | Security Update 2020-001 |
| Apple | Macos | < 10.15.7 | — |
| Apple | Macos | >= 11.0, < 11.6.6 | — |
| Apple | Macos | >= 12.0, < 12.4 | — |
References
- http://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
- http://seclists.org/fulldisclosure/2022/May/33Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2022/May/35Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2022/May/38Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/12/20/4Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202208-20Third Party Advisory
- https://security.netapp.com/advisory/ntap-20211224-0001/Third Party Advisory
- https://support.apple.com/kb/HT213255Third Party Advisory
- https://support.apple.com/kb/HT213256Third Party Advisory
- https://support.apple.com/kb/HT213257Third Party Advisory
- https://www.debian.org/security/2022/dsa-5035Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
- https://www.tenable.com/security/tns-2022-01Third Party Advisory
- https://www.tenable.com/security/tns-2022-03Third Party Advisory
- http://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
- http://seclists.org/fulldisclosure/2022/May/33Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2022/May/35Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2022/May/38Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/12/20/4Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202208-20Third Party Advisory
- https://security.netapp.com/advisory/ntap-20211224-0001/Third Party Advisory
- https://support.apple.com/kb/HT213255Third Party Advisory
- https://support.apple.com/kb/HT213256Third Party Advisory
- https://support.apple.com/kb/HT213257Third Party Advisory
- https://www.debian.org/security/2022/dsa-5035Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
- https://www.tenable.com/security/tns-2022-01Third Party Advisory
- https://www.tenable.com/security/tns-2022-03Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2021-44790?
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
How severe is CVE-2021-44790?
CVE-2021-44790 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 97.11% probability of exploitation in the next 30 days.
How do I fix CVE-2021-44790?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-44785Rejected reason: Not used
- CVE-2021-44786Rejected reason: Not used
- CVE-2021-44787Rejected reason: Not used
- CVE-2021-44788Rejected reason: Not used
- CVE-2021-44789Rejected reason: Not used
- CVE-2021-4479Dräger Atlan A350 versions 1.00 up to and including 1.01 con…6.3
- CVE-2021-44791In Apache Druid 0.22.1 and earlier, certain specially-crafte…6.1
- CVE-2021-44792Single Connect does not perform an authorization check when …5.3
- CVE-2021-44793Single Connect does not perform an authorization check when …8.6
- CVE-2021-44794Single Connect does not perform an authorization check when …5.3
- CVE-2021-44795Single Connect does not perform an authorization check when …5.3
- CVE-2021-4480Dräger Protector Software prior to version 6.4.2 contains a …8.3
Are you affected by CVE-2021-44790?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST