5.8
CVSSv2

CVE-2022-22721

Published: 14/03/2022 Updated: 07/11/2023
CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 9.1 | Impact Score: 5.2 | Exploitability Score: 3.9
VMScore: 518
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P

Vulnerability Summary

If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and previous versions.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache http server

fedoraproject fedora 34

fedoraproject fedora 35

fedoraproject fedora 36

debian debian linux 9.0

oracle http server 12.2.1.3.0

oracle http server 12.2.1.4.0

oracle enterprise manager ops center 12.4.0.0

oracle zfs storage appliance kit 8.8

apple mac os x

apple mac os x 10.15.7

apple macos

Vendor Advisories

Several security issues were fixed in Apache HTTP Server ...
Several security issues were fixed in Apache HTTP Server ...
A flaw was found in the mod_lua module of httpd A crafted request body can cause a read to a random memory area due to an uninitialized value in functions called by the parsebody function The highest treat of this vulnerability is availability (CVE-2022-22719) A flaw was found in httpd The inbound connection is not closed when it fails to disca ...
Synopsis Moderate: httpd:24 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the httpd:24 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update ...
Synopsis Moderate: httpd security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for httpd is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this ...
Synopsis Moderate: httpd24-httpd security and bug fix update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for httpd24-httpd is now available for Red Hat Software CollectionsRed Hat Product Security has rated ...
Synopsis Moderate: Red Hat JBoss Core Services Apache HTTP Server 2451 SP1 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update is now available for Red Hat JBoss Core ServicesRed Hat Product Securi ...
Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2451 SP1 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Core ServicesRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base sco ...
A flaw was found in the mod_lua module of httpd A crafted request body can cause a read to a random memory area due to an uninitialized value in functions called by the parsebody function The highest treat of this vulnerability is availability (CVE-2022-22719) A flaw was found in httpd The inbound connection is not closed when it fails to disca ...
If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes This issue affects Apache HTTP Server 2452 and earlier ...
A flaw was found in the mod_lua module of httpd A crafted request body can cause a read to a random memory area due to an uninitialized value in functions called by the parsebody function The highest treat of this vulnerability is availability (CVE-2022-22719) A flaw was found in httpd The inbound connection is not closed when it fails to disca ...
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available Recent releases are listed on the Apple security updates page Apple security documents reference vulnerabilities by CVE-ID&nbsp ...