CVE-2022-30522 mod_sed denial of service
Attackers can cause a denial of service in Apache HTTP Server by triggering excessive memory allocations in mod_sed when processing large inputs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-30522?
CVE-2022-30522 is a high-severity denial of service vulnerability in Apache Http Server, published on 8 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.
Which versions are affected by CVE-2022-30522?
1 open source package ship an affected version, including apache. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | From 2.4.53 | 2.4.54 |
Products include Apache Http Server, Fedoraproject Fedora, Netapp Clustered Data Ontap.
How do I fix CVE-2022-30522?
Upgrade apache to 2.4.54 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-30522 being exploited?
There is no known exploitation of CVE-2022-30522 in the wild and no public exploit code.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2022-30522, BIT-apache-2022-30522, CLEANSTART-2026-SW90026, CLSA-2025-1739823342, CLSA-2025-1741635876, DEBIAN-CVE-2022-30522 and 3 more.