CVE-2022-22728
libapreq2 multipart form parse memory corruption
- State
- Published
- Severity
- Not scored
- Published
- Aug 25, 2022
- Updated
- Aug 3, 2024
- Reserved
- Jan 6, 2022
Description
A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a request causing a process crash which could lead to a denial of service attack.
Scores
The record has no CVSS score.
Weaknesses
- CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected Products
| Product | Versions |
|---|---|
libapreq2Apache Software Foundation |
|
References
- https://lists.apache.org/thread/2fsjoor96d47vtkpf76x4yo06nccvy1y
- [oss-security] 20220825 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionmailing-list
- [oss-security] 20220825 CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionmailing-list
- [oss-security] 20220826 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionmailing-list
- FEDORA-2022-9e5046934evendor-advisory
- FEDORA-2022-cf658a432fvendor-advisory
- FEDORA-2022-61f5b492b7vendor-advisory
- [oss-security] 20221229 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionmailing-list
- [oss-security] 20221230 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionmailing-list
- [oss-security] 20221231 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionmailing-list
- [oss-security] 20221231 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionmailing-list
- [oss-security] 20230102 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionmailing-list
- [oss-security] 20230102 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionmailing-list
- [oss-security] 20230103 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionmailing-list
- [debian-lts-announce] 20230114 [SECURITY] [DLA 3269-1] libapreq2 security updatemailing-list
- GLSA-202305-20vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.