{"cve":"CVE-2021-44790","nvd":{"published":"2021-12-20T12:15:07.440","modified":"2026-06-17T04:12:50.913","status":"Analyzed","description":"A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-787"],"references":["http://httpd.apache.org/security/vulnerabilities_24.html","http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html","http://seclists.org/fulldisclosure/2022/May/33","http://seclists.org/fulldisclosure/2022/May/35","http://seclists.org/fulldisclosure/2022/May/38"],"products":["apache:http_server","apple:mac_os_x","apple:macos","debian:debian_linux","fedoraproject:fedora","netapp:cloud_backup","oracle:communications_element_manager","oracle:communications_operations_monitor","oracle:communications_session_report_manager","oracle:communications_session_route_manager","oracle:http_server","oracle:instantis_enterprisetrack","oracle:zfs_storage_appliance_kit","tenable:tenable.sc"],"source":"nvd","synced_at":"2026-10-19T21:25:41.256909649+00:00"},"epss":{"cve":"CVE-2021-44790","score":0.9684,"percentile":0.99888,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}