Critical severity · published Mar 14, 2022
CVE-2022-22721
If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes
9.1
CVSS
41.7%
EPSS
No
On KEV
Description
If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)41.7% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HS
HTTP Server · Apache
through 2.4.52 · source: NVD
MA
macOS · Apple
11.0 before 11.6.6; 12.0 before 12.4 · source: NVD
DL
Debian Linux · Debian
9.0 · source: NVD
EM
Enterprise Manager Ops Center · Oracle
12.4.0.0 · source: NVD
FE
Fedora · Fedoraproject
34; 35; 36 · source: NVD
MO
Mac OS X · Apple
10.15 before 10.15.7; 10.15.7; 10.15.7; 10.15.7; 10.15.7; 10.15.7; +7 more · source: NVD
ZS
Zfs Storage Appliance Kit · Oracle
8.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-22721
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-22721
Third Party Advisory
http://seclists.org/fulldisclosure/2022/May/33
Third Party Advisory
http://seclists.org/fulldisclosure/2022/May/35
Third Party Advisory
http://seclists.org/fulldisclosure/2022/May/38
Mailing List
http://www.openwall.com/lists/oss-security/2022/03/14/2
Vendor Advisory
https://httpd.apache.org/security/vulnerabilities_24.html
Mailing List
https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html
More from HTTP Server
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
9.8
CVE-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
9.1
CVE-2024-38475
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
9.0
CVE-2021-40438
mod_proxy SSRF
7.8
CVE-2019-0211
Apache HTTP Server Privilege Escalation Vulnerability