critical CVSS 10 EPSS 97% Public exploit available

CVE-2021-44790·Apache vulnerability

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

Severity
critical
Software
Apache
Fixed in
2.4.52-1
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 97% — in the top 0.1% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 2.4.52-1

Fixed in: 2.4.52-1

How to fix this CVE

Immediately upgrade Apache HTTP Server to version 2.4.52-1 or later to patch the mod_lua multipart parser buffer overflow vulnerability. Organizations running Apache 2.4.51 and earlier with mod_lua enabled should prioritize this update, as the flaw allows unauthenticated remote attackers to trigger memory corruption through specially crafted HTTP request bodies. Verify the fix by confirming the installed version matches or exceeds the patched release.

sudo dnf update httpd

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|PUT request with Content-Type: multipart/form-data and Content-Length header value exceeding typical boundaries (e.g., >10MB without legitimate justification); presence of malformed boundary markers or chunks without proper length declaration in multipart payload.

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Implement WAF rules to limit multipart/form-data request body size to reasonable thresholds (e.g., 5-10MB max), enforce strict Content-Length validation, block requests with malformed multipart boundaries, and rate-limit POST/PUT requests from single IPs targeting Lua-enabled endpoints.

How to check if you are affected

  1. Step 1: Check installed Apache version with 'apache2ctl -v' (Debian/Ubuntu) or 'httpd -v' (RHEL/CentOS) and confirm it is 2.4.52-1 or later.
  2. Step 2: Verify if mod_lua is enabled by running 'apache2ctl -M | grep lua_module' (Debian/Ubuntu) or 'httpctl -M | grep lua_module' (RHEL/CentOS); if it appears in output, the vulnerable parser is active.
  3. Step 3: Search Apache error and access logs for unusual multipart form data submissions or requests with oversized Content-Length headers using 'grep -i multipart /var/log/apache2/error.log' or 'grep -E 'Content-Length: [0-9]{7,}' /var/log/apache2/access.log'.
  4. Step 4: After applying updates, re-run 'apache2ctl -v' or 'httpd -v' to confirm version is 2.4.52-1 or newer, then restart Apache with 'sudo systemctl restart apache2' (Debian/Ubuntu) or 'sudo systemctl restart httpd' (RHEL/CentOS).

FAQ

What is CVE-2021-44790?

CVE-2021-44790 is a critical buffer overflow vulnerability in Apache mod_lua's multipart request parser that occurs when the r:parsebody() Lua function processes a malicious HTTP request body. An unauthenticated attacker can exploit this remotely to corrupt memory and potentially execute arbitrary code.

Is CVE-2021-44790 being actively exploited?

CVE-2021-44790 is not currently listed in CISA's Known Exploited Vulnerabilities catalog, but public proof-of-concept code exists on Exploit-DB, making active exploitation a realistic threat.

What versions of Apache are affected by CVE-2021-44790?

Apache HTTP Server versions 2.4.51 and all earlier releases are vulnerable. The vulnerability is fixed in version 2.4.52-1 and subsequent releases.

How do I check if my server is vulnerable to CVE-2021-44790?

Run 'apache2ctl -v' or 'httpd -v' to check your version; if it returns 2.4.51 or lower and 'apache2ctl -M | grep lua_module' shows the mod_lua module is loaded, your server is vulnerable.

Does Defensia detect CVE-2021-44790?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Apache is installed on a monitored server, CVE-2021-44790 will appear in your dashboard with remediation steps.

Related Apache CVEs

CVE-2021-41773CVSS 10A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
CVE-2021-42013CVSS 10It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
CVE-2024-38474CVSS 9.8Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.
CVE-2024-38476CVSS 9.8Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
CVE-2026-57941CVSS 9.8Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2021-44790. Free for 1 server.

Get started free