Apache HTTP Server contains critical vulnerabilities in optional modules like mod_lua and proxy handling that can lead to crashes, data leaks, or even remote code execution, so immediate patching is strongly recommended.

Overshadowing Other Apache Security Risks

While attention remains fixed on Log4Shell, many other critical security issues in Apache’s ecosystem risk being ignored.

Apache: More Than Just Log4j

The Apache Software Foundation is widely known for Log4j, but it also maintains other essential infrastructure software like web servers and backend tools.

Apache HTTP Server Still Runs the Internet

Apache HTTP Server (commonly called “httpd”) remains one of the most widely used web servers globally, powering countless websites and services.

Large Codebase, Large Attack Surface

With millions of lines of code and multiple optional modules, httpd is powerful but also complex, increasing the risk of security vulnerabilities across different configurations.

Continuous Updates and Security Patching

Despite its complexity, Apache HTTP Server is actively maintained, receiving frequent updates that include both feature improvements and critical security fixes.

New Vulnerabilities Discovered in httpd

Recent patches address two key vulnerabilities: CVE-2021-44790 and CVE-2021-44224, both affecting specific modules and configurations.

Risk Area: mod_lua and Multipart Processing

The first vulnerability affects the mod_lua module, which allows Lua scripting inside Apache, and can be triggered via unsafe handling of multipart form data. Even though mod_lua is powerful and often used in trusted environments, improperly handled input can still lead to buffer overflows or code manipulation. The second vulnerability involves forward proxy configurations, potentially allowing null pointer issues or Server-Side Request Forgery (SSRF). Even if these modules are optional, they may still be enabled unknowingly, putting production systems at risk of crashes, data leakage, or remote code execution.