If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.

OSVersionArchitecturePackageVersionFilename
Debian12allapache2< 2.4.53-1apache2_2.4.53-1_all.deb
Debian11allapache2< 2.4.53-1~deb11u1apache2_2.4.53-1~deb11u1_all.deb
Debian10allapache2< 2.4.38-3+deb10u8apache2_2.4.38-3+deb10u8_all.deb
Debian999allapache2< 2.4.53-1apache2_2.4.53-1_all.deb
Debian13allapache2< 2.4.53-1apache2_2.4.53-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	apache2	< 2.4.53-1	apache2_2.4.53-1_all.deb
Debian	11	all	apache2	< 2.4.53-1~deb11u1	apache2_2.4.53-1~deb11u1_all.deb
Debian	10	all	apache2	< 2.4.38-3+deb10u8	apache2_2.4.38-3+deb10u8_all.deb
Debian	999	all	apache2	< 2.4.53-1	apache2_2.4.53-1_all.deb
Debian	13	all	apache2	< 2.4.53-1	apache2_2.4.53-1_all.deb

prion 1

alpinelinux 1

ubuntucve 1

f5 1

zdi 1

ibm 18

osv 9

veracode 1

cve 1

httpd 1

cbl_mariner 2

redhatcve 1

nessus 50

openvas 34

cloudlinux 1

suse 1

slackware 1

altlinux 2

amazon 2

redos 1

debian 1

ubuntu 2

kaspersky 1

mageia 1

fedora 3

freebsd 1

photon 5

thn 1

oraclelinux 2

almalinux 2

rocky 2

redhat 5

rosalinux 1

gentoo 1

apple 3

oracle 3

prion

Integer overflow

2022-03-14 11:15:00

alpinelinux

CVE-2022-22721

2022-03-14 11:15:00

ubuntucve

CVE-2022-22721

2022-03-14 00:00:00

K20451100 : Apache vulnerability CVE-2022-22721

2022-04-12 00:00:00

zdi

Apache HTTPD Server ap_escape_html2 Integer Overflow Remote Code Execution Vulnerability

2022-06-29 00:00:00

ibm

Security Bulletin: IBM Rational Build Forge is affected by Apache HTTP Server version used in it. (CVE-2022-22721)

2022-07-12 13:19:21

Security Bulletin: IBM Aspera Orchestrator affected by buffer overflow vulnerability ( CVE-2022-22721)

2023-02-02 17:41:29

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use Mapping Assistance may be vulnerable to arbitrary code execution due to CVE-2022-22721

2022-11-07 16:12:40

osv

CVE-2022-22721

2022-03-14 11:15:09

BIT-apache-2022-22721

2024-03-06 10:53:38

apache2 vulnerabilities

2022-03-17 11:31:47

veracode

Integer Overflow

2022-03-15 10:12:50

cve

CVE-2022-22721

2022-03-14 11:15:00

httpd

Apache Httpd < 2.4.53 : core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody

2022-03-14 00:00:00

cbl_mariner

CVE-2022-22721 affecting package httpd 2.4.52-1

2022-04-07 06:04:02

CVE-2022-22721 affecting package httpd 2.4.52-1

2022-04-26 19:57:38

redhatcve

CVE-2022-22721

2022-03-15 14:43:53

nessus

SUSE SLES11 Security Update : apache2 (SUSE-SU-2022:14924-1)

2022-03-22 00:00:00

Oracle Enterprise Manager Ops Center (Jul 2022 CPU)

2022-07-22 00:00:00

EulerOS 2.0 SP9 : httpd (EulerOS-SA-2022-1867)

2022-06-15 00:00:00

openvas

SUSE: Security Advisory (SUSE-SU-2022:14924-1)

2022-03-22 00:00:00

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2022-1790)

2022-06-07 00:00:00

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2022-1893)

2022-06-17 00:00:00

cloudlinux

Fix of CVE: CVE-2022-22721, CVE-2022-22720

2022-03-24 15:36:17

suse

Security update for apache2 (important)

2022-03-29 00:00:00

slackware

[slackware-security] httpd

2022-03-15 01:06:06

altlinux

Security fix for the ALT Linux 9 package apache2 version 1:2.4.53-alt1

2022-03-29 00:00:00

Security fix for the ALT Linux 10 package apache2 version 1:2.4.53-alt1

2022-03-25 00:00:00

amazon

Important: httpd24

2022-04-26 17:12:00

Important: httpd

2022-04-25 22:57:00

redos

ROS-20220317-01

2022-03-17 00:00:00

debian

[SECURITY] [DLA 2960-1] apache2 security update

2022-03-22 07:32:37

ubuntu

Apache HTTP Server vulnerabilities

2022-03-17 00:00:00

Apache HTTP Server vulnerabilities

2022-03-17 00:00:00

kaspersky

KLA12485 Multiple vulnerabilities in Apache HTTP Server

2022-03-14 00:00:00

mageia

Updated apache packages fix security vulnerability

2022-03-21 23:18:30

fedora

[SECURITY] Fedora 34 Update: httpd-2.4.53-1.fc34

2022-03-25 22:06:50

[SECURITY] Fedora 36 Update: httpd-2.4.53-1.fc36

2022-03-26 15:55:33

[SECURITY] Fedora 35 Update: httpd-2.4.53-1.fc35

2022-03-22 03:44:42

freebsd

Apache httpd -- Multiple vulnerabilities

2022-03-14 00:00:00

photon

Critical Photon OS Security Update - PHSA-2022-0455

2022-03-25 00:00:00

Critical Photon OS Security Update - PHSA-2022-0166

2022-03-25 00:00:00

Critical Photon OS Security Update - PHSA-2022-4.0-0166

2022-03-25 00:00:00

thn

QNAP Advises Users to Update NAS Firmware to Patch Apache HTTP Vulnerabilities

2022-04-22 08:15:00

oraclelinux

httpd:2.4 security update

2022-11-15 00:00:00

httpd security, bug fix, and enhancement update

2022-11-22 00:00:00

almalinux

Moderate: httpd:2.4 security update

2022-11-08 00:00:00

Moderate: httpd security, bug fix, and enhancement update

2022-11-15 00:00:00

rocky

httpd:2.4 security update

2022-11-08 06:25:28

httpd security, bug fix, and enhancement update

2022-11-15 06:14:59

redhat

(RHSA-2022:7647) Moderate: httpd:2.4 security update

2022-11-08 06:25:28

(RHSA-2022:8067) Moderate: httpd security, bug fix, and enhancement update

2022-11-15 06:14:59

(RHSA-2022:6753) Moderate: httpd24-httpd security and bug fix update

2022-09-29 13:20:41

rosalinux

Advisory ROSA-SA-2023-2160

2023-04-25 12:02:31

gentoo

Apache HTTPD: Multiple Vulnerabilities

2022-08-14 00:00:00

apple

About the security content of Security Update 2022-004 Catalina

2022-05-16 00:00:00

About the security content of macOS Big Sur 11.6.6

2022-05-16 00:00:00

About the security content of macOS Monterey 12.4

2022-05-16 00:00:00

oracle

Oracle Critical Patch Update Advisory - January 2023

2023-01-17 00:00:00

Oracle Critical Patch Update Advisory - July 2022

2022-07-19 00:00:00

Oracle Critical Patch Update Advisory - April 2022

2022-04-19 00:00:00

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

0.003 Low

EPSS

Percentile

71.2%

JSON

Related for DEBIANCVE:CVE-2022-22721