CVE-2022-28614

MEDIUM 5.3CVE-2022-28614 · Published 09/06/2022 · updated 17/06/2026

In short

CVE-2022-28614 is a MEDIUM (CVSS 5.3) vulnerability affecting http server (apache).
Chance of exploitation in the next 30 days (EPSS): 5.0%, higher than 92.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
http server apache	`≤ 2.4.53`	No fix yet

Description

The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.

References

openwall.com/lists/oss-security/2022/06/08/4 · Mailing List
httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND
security.gentoo.org/glsa/202208-20 · Third Party Advisory
security.netapp.com/advisory/ntap-20220624-0005 · Third Party Advisory

More vulnerabilities in http server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

http server

apache

≤ 2.4.53

No fix yet

Description

More vulnerabilities in http server

See all →