CVE-2022-22728: libapreq2 multipart form parse memory corruption

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-25 · updated 2026-06-17
Weakness: CWE-120

Description

A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a request causing a process crash which could lead to a denial of service attack.

Affected products

Apache Software Foundation libapreq2: through 2.16
Debian Linux: 10.0
Fedoraproject Fedora: 35, 36, 37

References

http://www.openwall.com/lists/oss-security/2022/08/25/3
http://www.openwall.com/lists/oss-security/2022/08/25/4
http://www.openwall.com/lists/oss-security/2022/08/26/4
http://www.openwall.com/lists/oss-security/2022/12/29/1
http://www.openwall.com/lists/oss-security/2022/12/30/4
http://www.openwall.com/lists/oss-security/2022/12/31/1
http://www.openwall.com/lists/oss-security/2022/12/31/5
http://www.openwall.com/lists/oss-security/2023/01/02/1
http://www.openwall.com/lists/oss-security/2023/01/02/2
http://www.openwall.com/lists/oss-security/2023/01/03/2
https://lists.apache.org/thread/2fsjoor96d47vtkpf76x4yo06nccvy1y
https://lists.debian.org/debian-lts-announce/2023/01/msg00009.html

Get alerted when CVE-2022-22728 or the next vulnerability affects your stack