CVE-2021-44790: Apache HTTP Server mod_lua multipart parser buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, a very high EPSS score and public exploit material make this a top patching priority where mod_lua is exposed.

What it is

A crafted request body triggers an out-of-bounds write in the mod_lua multipart parser when r:parsebody() is called from Lua scripts. The flaw affects Apache HTTP Server 2.4.51 and earlier and can corrupt memory in the server process. Because the vulnerable code path is only reachable when a Lua script invokes r:parsebody(), exposure depends on the server's mod_lua configuration.

Impact

An unauthenticated remote attacker can corrupt memory in the httpd process, which may lead to code execution or a denial of service. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached over the network by sending a crafted request body to an endpoint whose Lua script calls r:parsebody(); the CVSS vector shows no privileges or user interaction required. Actual reachability requires mod_lua to be enabled and a script using that parser.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.9684, 99.885th percentile) and a Packet Storm reference is tagged Exploit, indicating public exploit material exists. The Apache advisory states the team was not aware of an exploit at publication.

What to do

• Upgrade Apache HTTP Server to a version later than 2.4.51 that contains the mod_lua fix.
• If mod_lua is not required, disable or unload the module to remove the vulnerable code path.
• Audit Lua scripts for r:parsebody() usage and restrict or rewrite those handlers where possible.
• Apply vendor patches for downstream packages (Debian, Fedora, Oracle, NetApp, Apple) that bundle the affected httpd.
• Where patching is delayed, limit exposure of Lua-backed endpoints with network controls and request body size limits.

Detection

• Monitor httpd logs for crashes, restarts or abnormal child process termination correlated with multipart POST requests.
• Inspect request bodies to Lua-backed endpoints for malformed or oversized multipart boundaries and parts.
• Use host-based memory corruption or exploit detection tooling on httpd processes handling mod_lua requests.
• Check for unexpected outbound connections or new processes spawned by the httpd user after multipart uploads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.