CVE-2022-22721 core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody
An integer overflow in Apache HTTP Server on 32-bit systems can lead to out-of-bounds writes and potential code execution if LimitXMLRequestBody is set excessively high.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-22721?
CVE-2022-22721 is a critical vulnerability in Apache Http Server, published on 14 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.
Weakness: CWE-190
Which versions are affected by CVE-2022-22721?
1 open source package ship an affected version, including apache. It affects 8 products.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | All versions | 2.4.53 |
Products include Apache Http Server, Apple Mac Os X, Apple Macos, Debian Debian Linux, Fedoraproject Fedora, Oracle Enterprise Manager Ops Center and 2 more.
How do I fix CVE-2022-22721?
Upgrade apache to 2.4.53 or later.
Is CVE-2022-22721 being exploited?
There is no known exploitation of CVE-2022-22721 in the wild and no public exploit code.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2022-22721, AZL-9017, BIT-apache-2022-22721, CLEANSTART-2026-UC87477, DEBIAN-CVE-2022-22721, GHSA-24r7-x8mx-hc2h and 1 more.