CVE-2022-22721
core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody
- State
- Published
- Severity
- Not scored
- Published
- Mar 14, 2022
- Updated
- Aug 3, 2024
- Reserved
- Jan 6, 2022
Description
If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.
Scores
The record has no CVSS score.
Weaknesses
- CWE-190 Integer Overflow or Wraparound
Affected Products
| Product | Versions |
|---|---|
Apache HTTP ServerApache Software Foundation |
|
References
- https://httpd.apache.org/security/vulnerabilities_24.html
- [oss-security] 20220314 CVE-2022-22721: Apache HTTP Server: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBodymailing-list
- FEDORA-2022-b4103753e9vendor-advisory
- [debian-lts-announce] 20220322 [SECURITY] [DLA 2960-1] apache2 security updatemailing-list
- FEDORA-2022-21264ec6dbvendor-advisory
- FEDORA-2022-78e3211c55vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220321-0001/
- 20220516 APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalinamailing-list
- 20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6mailing-list
- 20220516 APPLE-SA-2022-05-16-2 macOS Monterey 12.4mailing-list
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://support.apple.com/kb/HT213257
- https://support.apple.com/kb/HT213256
- https://support.apple.com/kb/HT213255
- GLSA-202208-20vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.