Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2021-44790

critical

CVE-2021-44790

httpd: mod_lua: Possible buffer overflow when parsing multipart content

Published Modified CWE 787
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD, Bitnami, CBL-Mariner, Photon OS. Rated lower by Red Hat (high), AlmaLinux (high), Amazon (high), Oracle (high), Rocky Linux (high), Ubuntu (medium).

Description

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

Affected packages and fixed versions

SourcePackageFixed in
bitnami::Bitnami Vulnerability Databaseapache2.4.52
CBL-Mariner 1.0httpd0:2.4.52-1.cm1
CBL-Mariner 2.0httpd0:2.4.52-1.cm2
Photon OS 1.0httpd2.4.52-1.ph1
Photon OS 2.0httpd2.4.52-1.ph2
Photon OS 3.0httpd2.4.52-1.ph3
Photon OS 4.0httpd, httpd-devel, httpd-docs and 1 more2.4.52-1.ph4
alma 8httpd:2.4::httpd, httpd:2.4::httpd-devel, httpd:2.4::httpd-filesystem and 8 more2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma and 3 more
alpine 3.12apache22.4.52-r0
alpine 3.13apache22.4.52-r0
alpine 3.14apache22.4.52-r0
alpine 3.15apache22.4.52-r0
Show all 144 entries from 47 sources
SourcePackageFixed in
bitnami::Bitnami Vulnerability Databaseapache2.4.52
CBL-Mariner 1.0httpd0:2.4.52-1.cm1
CBL-Mariner 2.0httpd0:2.4.52-1.cm2
Photon OS 1.0httpd2.4.52-1.ph1
Photon OS 2.0httpd2.4.52-1.ph2
Photon OS 3.0httpd2.4.52-1.ph3
Photon OS 4.0httpd2.4.52-1.ph4
Photon OS 4.0httpd-devel2.4.52-1.ph4
Photon OS 4.0httpd-docs2.4.52-1.ph4
Photon OS 4.0httpd-tools2.4.52-1.ph4
alma 8httpd:2.4::httpd2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma
alma 8httpd:2.4::httpd-devel2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma
alma 8httpd:2.4::httpd-filesystem2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma
alma 8httpd:2.4::httpd-manual2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma
alma 8httpd:2.4::httpd-tools2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma
alma 8httpd:2.4::mod_http21.15.7-3.module_el8.5.0+2609+b30d9eec
alma 8httpd:2.4::mod_ldap2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma
alma 8httpd:2.4::mod_md1:2.0.8-8.module_el8.5.0+2609+b30d9eec
alma 8httpd:2.4::mod_proxy_html1:2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma
alma 8httpd:2.4::mod_session2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma
alma 8httpd:2.4::mod_ssl1:2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma
alpine 3.12apache22.4.52-r0
alpine 3.13apache22.4.52-r0
alpine 3.14apache22.4.52-r0
alpine 3.15apache22.4.52-r0
alpine 3.16apache22.4.52-r0
alpine 3.17apache22.4.52-r0
alpine 3.18apache22.4.52-r0
alpine 3.19apache22.4.52-r0
alpine 3.20apache22.4.52-r0
alpine 3.21apache22.4.52-r0
alpine 3.22apache22.4.52-r0
alpine 3.23apache22.4.52-r0
alpine 3.24apache22.4.52-r0
alpine edgeapache22.4.52-r0
amazon linux 1httpd242.4.52-1.95.amzn1
amazon linux 1httpd24-debuginfo2.4.52-1.95.amzn1
amazon linux 1httpd24-devel2.4.52-1.95.amzn1
amazon linux 1httpd24-manual2.4.52-1.95.amzn1
amazon linux 1httpd24-tools2.4.52-1.95.amzn1
amazon linux 1mod24_ldap2.4.52-1.95.amzn1
amazon linux 1mod24_md2.4.52-1.95.amzn1
amazon linux 1mod24_proxy_html1:2.4.52-1.95.amzn1
amazon linux 1mod24_session2.4.52-1.95.amzn1
amazon linux 1mod24_ssl1:2.4.52-1.95.amzn1
amazon linux 2httpd2.4.52-1.amzn2
amazon linux 2httpd-debuginfo2.4.52-1.amzn2
amazon linux 2httpd-devel2.4.52-1.amzn2
amazon linux 2httpd-filesystem2.4.52-1.amzn2
amazon linux 2httpd-manual2.4.52-1.amzn2
amazon linux 2httpd-tools2.4.52-1.amzn2
amazon linux 2mod_ldap2.4.52-1.amzn2
amazon linux 2mod_md2.4.52-1.amzn2
amazon linux 2mod_proxy_html1:2.4.52-1.amzn2
amazon linux 2mod_session2.4.52-1.amzn2
amazon linux 2mod_ssl1:2.4.52-1.amzn2
amazon linux 2022httpd2.4.54-3.amzn2022.0.3
amazon linux 2022httpd-core2.4.54-3.amzn2022.0.3
amazon linux 2022httpd-core-debuginfo2.4.54-3.amzn2022.0.3
amazon linux 2022httpd-debuginfo2.4.54-3.amzn2022.0.3
amazon linux 2022httpd-debugsource2.4.54-3.amzn2022.0.3
amazon linux 2022httpd-devel2.4.54-3.amzn2022.0.3
amazon linux 2022httpd-filesystem2.4.54-3.amzn2022.0.3
amazon linux 2022httpd-manual2.4.54-3.amzn2022.0.3
amazon linux 2022httpd-tools2.4.54-3.amzn2022.0.3
amazon linux 2022httpd-tools-debuginfo2.4.54-3.amzn2022.0.3
amazon linux 2022mod_ldap2.4.54-3.amzn2022.0.3
amazon linux 2022mod_ldap-debuginfo2.4.54-3.amzn2022.0.3
amazon linux 2022mod_lua2.4.54-3.amzn2022.0.3
amazon linux 2022mod_lua-debuginfo2.4.54-3.amzn2022.0.3
amazon linux 2022mod_proxy_html1:2.4.54-3.amzn2022.0.3
amazon linux 2022mod_proxy_html-debuginfo1:2.4.54-3.amzn2022.0.3
amazon linux 2022mod_session2.4.54-3.amzn2022.0.3
amazon linux 2022mod_session-debuginfo2.4.54-3.amzn2022.0.3
amazon linux 2022mod_ssl1:2.4.54-3.amzn2022.0.3
amazon linux 2022mod_ssl-debuginfo1:2.4.54-3.amzn2022.0.3
amazon linux 2023httpd2.4.54-3.amzn2023.0.4
amazon linux 2023httpd-core2.4.54-3.amzn2023.0.4
amazon linux 2023httpd-core-debuginfo2.4.54-3.amzn2023.0.4
amazon linux 2023httpd-debuginfo2.4.54-3.amzn2023.0.4
amazon linux 2023httpd-debugsource2.4.54-3.amzn2023.0.4
amazon linux 2023httpd-devel2.4.54-3.amzn2023.0.4
amazon linux 2023httpd-filesystem2.4.54-3.amzn2023.0.4
amazon linux 2023httpd-manual2.4.54-3.amzn2023.0.4
amazon linux 2023httpd-tools2.4.54-3.amzn2023.0.4
amazon linux 2023httpd-tools-debuginfo2.4.54-3.amzn2023.0.4
amazon linux 2023mod_ldap2.4.54-3.amzn2023.0.4
amazon linux 2023mod_ldap-debuginfo2.4.54-3.amzn2023.0.4
amazon linux 2023mod_lua2.4.54-3.amzn2023.0.4
amazon linux 2023mod_lua-debuginfo2.4.54-3.amzn2023.0.4
amazon linux 2023mod_proxy_html1:2.4.54-3.amzn2023.0.4
amazon linux 2023mod_proxy_html-debuginfo1:2.4.54-3.amzn2023.0.4
amazon linux 2023mod_session2.4.54-3.amzn2023.0.4
amazon linux 2023mod_session-debuginfo2.4.54-3.amzn2023.0.4
amazon linux 2023mod_ssl1:2.4.54-3.amzn2023.0.4
amazon linux 2023mod_ssl-debuginfo1:2.4.54-3.amzn2023.0.4
debian 10apache22.4.38-3+deb10u7
debian 11apache22.4.52-1~deb11u2
debian 12apache22.4.52-1
debian 13apache22.4.52-1
debian 14apache22.4.52-1
debian 9apache22.4.25-3+deb9u12
echoapache22.4.52-1
Oracle Linux 7httpd2.4.6-97.0.5.el7_9.4
Oracle Linux 7httpd-devel2.4.6-97.0.5.el7_9.4
Oracle Linux 7httpd-manual2.4.6-97.0.5.el7_9.4
Oracle Linux 7httpd-tools2.4.6-97.0.5.el7_9.4
Oracle Linux 7mod_ldap2.4.6-97.0.5.el7_9.4
Oracle Linux 7mod_proxy_html1:2.4.6-97.0.5.el7_9.4
Oracle Linux 7mod_session2.4.6-97.0.5.el7_9.4
Oracle Linux 7mod_ssl1:2.4.6-97.0.5.el7_9.4
Oracle Linux 8httpd2.4.37-43.0.1.module+el8.5.0+20475+4f6a8fd5.1
Oracle Linux 8httpd-devel2.4.37-43.0.1.module+el8.5.0+20475+4f6a8fd5.1
Oracle Linux 8httpd-filesystem2.4.37-43.0.1.module+el8.5.0+20475+4f6a8fd5.1
Oracle Linux 8httpd-manual2.4.37-43.0.1.module+el8.5.0+20475+4f6a8fd5.1
Oracle Linux 8httpd-tools2.4.37-43.0.1.module+el8.5.0+20475+4f6a8fd5.1
Oracle Linux 8mod_http21.15.7-3.module+el8.4.0+20024+b87b2deb
Oracle Linux 8mod_ldap2.4.37-43.0.1.module+el8.5.0+20475+4f6a8fd5.1
Oracle Linux 8mod_md1:2.0.8-8.module+el8.5.0+20475+4f6a8fd5
Oracle Linux 8mod_proxy_html1:2.4.37-43.0.1.module+el8.5.0+20475+4f6a8fd5.1
Oracle Linux 8mod_session2.4.37-43.0.1.module+el8.5.0+20475+4f6a8fd5.1
Oracle Linux 8mod_ssl1:2.4.37-43.0.1.module+el8.5.0+20475+4f6a8fd5.1
rocky 8httpd:2.4::httpd2.4.37-43.module+el8.5.0+714+5ec56ee8
rocky 8httpd:2.4::httpd-devel2.4.37-43.module+el8.5.0+714+5ec56ee8
rocky 8httpd:2.4::httpd-filesystem2.4.37-43.module+el8.5.0+714+5ec56ee8
rocky 8httpd:2.4::httpd-manual2.4.37-43.module+el8.5.0+714+5ec56ee8
rocky 8httpd:2.4::httpd-tools2.4.37-43.module+el8.5.0+714+5ec56ee8
rocky 8httpd:2.4::mod_http21.15.7-3.module+el8.5.0+695+1fa8055e
rocky 8httpd:2.4::mod_ldap2.4.37-43.module+el8.5.0+714+5ec56ee8
rocky 8httpd:2.4::mod_md1:2.0.8-8.module+el8.5.0+695+1fa8055e
rocky 8httpd:2.4::mod_proxy_html1:2.4.37-43.module+el8.5.0+714+5ec56ee8
rocky 8httpd:2.4::mod_session2.4.37-43.module+el8.5.0+714+5ec56ee8
rocky 8httpd:2.4::mod_ssl1:2.4.37-43.module+el8.5.0+714+5ec56ee8
root.io debian 12rootio-apache22.4.52-1
root.io debian 13rootio-apache22.4.52-1
ubuntu 14.04-ESMapache22.4.7-1ubuntu4.22+esm3
ubuntu 16.04-ESMapache22.4.18-2ubuntu3.17+esm4
ubuntu 18.04apache22.4.29-1ubuntu4.21
ubuntu 18.04-ESMapache22.4.29-1ubuntu4.21
ubuntu 20.04apache22.4.41-4ubuntu3.9
ubuntu 20.04-ESMapache22.4.41-4ubuntu3.9
ubuntu 21.04apache22.4.46-4ubuntu1.5
ubuntu 21.10apache22.4.48-3.1ubuntu3.2
ubuntu 22.04apache22.4.52-1ubuntu1

References

All 32 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.