CVE-2022-22721

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-190

Affected software

VendorProductVersions
Apache Software FoundationApache HTTP Server>= Apache HTTP Server 2.4, <= 2.4.52

References

Timeline

Published
Mar 14, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-227227.5A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain theCVE-2022-227238.8A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and CVE-2022-227247.5A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 (HTTP) and 502 (Modbus), CVE-2022-227258.8A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and CVE-2022-227266.5A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users thCVE-2022-227278.8A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact CVE-2022-227287.5A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attackeCVE-2022-227298.8CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication CVE-2022-22738.8The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowiCVE-2022-227309.8Improper authentication in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an unauthenticated user to poteCVE-2022-227319.8A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a function that could allowCVE-2022-227327.5A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) supp
CVE-2022-22721: Critical severity, CVSS 9.1 | Vulnix