Vulnerability · Published Aug 25, 2022 · Assigned by apache
CVE-2022-22728libapreq2 multipart form parse memory corruption
High 7.5
In plain English
A high-severity buffer overflow in libapreq2 from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.9% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)5.9%top 6.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a request causing a process crash which could lead to a denial of service attack.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | libapreq2 | 2.17-1 | DEBIAN-CVE-2022-22728 |
| Ubuntu:22.04:LTS | libapreq2 | no fix listed | UBUNTU-CVE-2022-22728 |
| Ubuntu:24.04:LTS | libapreq2 | no fix listed | UBUNTU-CVE-2022-22728 |
| Ubuntu:25.10 | libapreq2 | no fix listed | UBUNTU-CVE-2022-22728 |
| Ubuntu:26.04:LTS | libapreq2 | no fix listed | UBUNTU-CVE-2022-22728 |
| Ubuntu:26.10 | libapreq2 | no fix listed | UBUNTU-CVE-2022-22728 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | libapreq2 | unspecified – through 2.16 |
Weakness: CWE-120
References
- https://lists.apache.org/thread/2fsjoor96d47vtkpf76x4yo06nccvy1y
- [oss-security] 20220825 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [oss-security] 20220825 CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [oss-security] 20220826 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- FEDORA-2022-9e5046934e vendor-advisory
- FEDORA-2022-cf658a432f vendor-advisory
- FEDORA-2022-61f5b492b7 vendor-advisory
- [oss-security] 20221229 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [oss-security] 20221230 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [oss-security] 20221231 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [oss-security] 20221231 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [oss-security] 20230102 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [oss-security] 20230102 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [oss-security] 20230103 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [debian-lts-announce] 20230114 [SECURITY] [DLA 3269-1] libapreq2 security update mailing-list
- GLSA-202305-20 vendor-advisory