CVEvulnerability
CVE-2022-22721
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-03-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:P
- Weaknesses
- CWE-190
Description
If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.
Affected configurations
• apache http server (<= 2.4.52)
• fedoraproject fedora 34
• fedoraproject fedora 35
• fedoraproject fedora 36
• debian debian linux 9.0
• oracle enterprise manager ops center 12.4.0.0
• oracle http server 12.2.1.3.0
• oracle http server 12.2.1.4.0
• oracle zfs storage appliance kit 8.8
• apple mac os x (>= 10.15 < 10.15.7)
• apple mac os x 10.15.7
• apple macos (>= 11.0 < 11.6.6)
• apple macos (>= 12.0 < 12.4)
Related
Weakness · CWE (1)
- CWE-190 Integer Overflow or Wraparound weakness
References
- http://seclists.org/fulldisclosure/2022/May/33 Third Party Advisory
- http://seclists.org/fulldisclosure/2022/May/35 Third Party Advisory
- http://seclists.org/fulldisclosure/2022/May/38 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/03/14/2 Mailing List, Third Party Advisory
- https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202208-20 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220321-0001/ Third Party Advisory
- https://support.apple.com/kb/HT213255 Third Party Advisory
- https://support.apple.com/kb/HT213256 Third Party Advisory
- https://support.apple.com/kb/HT213257 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
- http://seclists.org/fulldisclosure/2022/May/33 Third Party Advisory
- http://seclists.org/fulldisclosure/2022/May/35 Third Party Advisory
- http://seclists.org/fulldisclosure/2022/May/38 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/03/14/2 Mailing List, Third Party Advisory
- https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202208-20 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220321-0001/ Third Party Advisory
- https://support.apple.com/kb/HT213255 Third Party Advisory
- https://support.apple.com/kb/HT213256 Third Party Advisory
- https://support.apple.com/kb/HT213257 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory