CVE-2022-30522

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-789 CWE-770

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache HTTP Server	2.4.53

References

http://www.openwall.com/lists/oss-security/2022/06/08/6Mailing List, Third Party Advisory
https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/
https://security.gentoo.org/glsa/202208-20Third Party Advisory
https://security.netapp.com/advisory/ntap-20220624-0005/Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/06/08/6Mailing List, Third Party Advisory
https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/
https://security.gentoo.org/glsa/202208-20Third Party Advisory
https://security.netapp.com/advisory/ntap-20220624-0005/Third Party Advisory

Timeline

Published: Jun 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-305237.8Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Privilege Escalation Vulnerability th CVE-2022-305247.8There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters a CVE-2022-305259.8A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 f CVE-2022-305267.8A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLE CVE-2022-305277.8A vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application assigns improper access rights to specific CVE-2022-305289.8SQL Injection vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to execute arbitr CVE-2022-305297.2File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary CVE-2022-30534.3Inappropriate implementation in Pointer Lock in Google Chrome on Mac prior to 105.0.5195.52 allowed a remote attacker to restrict user navig CVE-2022-305307.8Protection mechanism failure in the Intel(R) DSA software before version 22.4.26 may allow an authenticated user to potentially enable escal CVE-2022-305315.5Out-of-bounds read in the Intel(R) Iris(R) Xe MAX drivers for Windows before version 100.0.5.1474 may allow a privileged user to potentially CVE-2022-305325.3In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy.CVE-2022-305335.4Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject