VDB
ALPINE-CVE-2021-44790
ALPINE-CVE-2021-44790
PUBLISHED
CVSS 9.800000190734863 CRITICAL
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
Risk Scores
CVSS v3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.21 | apache2 | 0, 2.2.16-r0, 2.2.16-r1 |
| Alpine:v3.16 | apache2 | 2.4.9-r1, 2.4.9-r0, 2.4.7-r0 |
| Alpine:v3.14 | apache2 | 2.4.9-r1, 2.4.9-r0, 2.4.7-r0 |
| Alpine:v3.13 | apache2 | 2.4.37-r1, 2.4.37-r0, 2.4.33-r1 |
| Alpine:v3.23 | apache2 | 2.4.27-r0, 2.4.27-r1, 2.4.27-r2 |
| Alpine:v3.19 | apache2 | 2.4.23-r10, 2.2.17-r4, 2.2.17-r3 |
| Alpine:v3.12 | apache2 | 2.4.12-r1, 2.4.12-r2, 2.4.12-r3 |
| Alpine:v3.15 | apache2 | 2.4.48-r1, 2.4.46-r3, 2.4.46-r2 |
| Alpine:v3.22 | apache2 | 2.2.17-r1, 2.4.6-r1, 2.4.18-r1 |
| Alpine:v3.17 | apache2 | 2.4.41-r0, 2.4.9-r0, 2.4.7-r0 |
| Alpine:v3.20 | apache2 | 0, 2.2.16-r0, 2.2.16-r1 |
| Alpine:v3.18 | apache2 | 2.4.18-r0, 2.2.16-r0, 2.2.16-r3 |
Timeline
- Dec 20, 2021 CVE Published
- Dec 3, 2025 CVE Updated
- Apr 30, 2026 Distribution Patch