The vulnerability (CVE-2021-44790) can be exploited via a carefully crafted request body that can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts).