What’s Vulnerable › Vulnerabilities

CVE-2022-24963: Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-01-31 · updated 2026-06-17
• Weakness: CWE-190

Description

Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.

Affected products

• Apache Software Foundation Apache Portable Runtime (APR): 1.7.0

References

• https://lists.apache.org/thread/fw9p6sdncwsjkstwc066vz57xqzfksq9
• https://security.netapp.com/advisory/ntap-20230908-0008/
• https://lists.apache.org/thread/fw9p6sdncwsjkstwc066vz57xqzfksq9
• https://security.netapp.com/advisory/ntap-20230908-0008/

Get alerted when CVE-2022-24963 or the next vulnerability affects your stack