CVE-2022-29404 Denial of service in mod_lua r:parsebody
A malicious request to a Lua script can cause a denial of service in Apache HTTP Server due to missing input size limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-29404?
CVE-2022-29404 is a high-severity denial of service vulnerability in Apache Http Server, published on 8 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.
Weakness: CWE-770
Which versions are affected by CVE-2022-29404?
1 open source package ship an affected version, including apache. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | All versions | 2.4.54 |
Products include Apache Http Server, Fedoraproject Fedora, Netapp Clustered Data Ontap.
How do I fix CVE-2022-29404?
Upgrade apache to 2.4.54 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-29404 being exploited?
There is no known exploitation of CVE-2022-29404 in the wild and no public exploit code.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2022-29404, BIT-apache-2022-29404, CLEANSTART-2026-PA56152, CLSA-2023-1689009164, CLSA-2026-1776965343, DEBIAN-CVE-2022-29404 and 1 more.