CVE-2024-22393 Apache Answer: Pixel Flood Attack by uploading the large pixel file

What is CVE-2024-22393?

CVE-2024-22393 is a critical vulnerability in Apache Answer, published on 22 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1.

Pixel Flood Attack by uploading large pixel files will cause server out of memory. A logged-in user can cause such an attack by uploading an image when posting content. Users are recommended to upgrade to version [1.2.5], which fixes the issue.

Weakness: CWE-434

Which versions are affected by CVE-2024-22393?

3 open source packages ship an affected version, including github.com/apache/incubator-answer. It affects 1 product.

Products include Apache Answer.

How do I fix CVE-2024-22393?

Upgrade github.com/apache/incubator-answer to 1.2.5 or later.

Is CVE-2024-22393 being exploited?

There is no known exploitation of CVE-2024-22393 in the wild and no public exploit code.

Public exploit code: 3 proofs of concept on GitHub.

Other vulnerabilities in Apache Answer

• CVE-2026-60053 Apache Answer: Residual Administrative API Key Access After Role or Account Revocation Critical 9.1
• CVE-2026-48834 Apache Answer: Denial of service via crafted Accept-Language header parsing High 7.5
• CVE-2026-48911 Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow High 7.5
• CVE-2026-60023 Apache Answer: Unauthorized disclosure of deleted or pending answer content High 7.5
• CVE-2026-24735 Apache Answer: Revision API Improper Access Control leads to Information Disclosure High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rmqp-mvv2-54c6, GO-2024-2579.