CVE-2023-31122

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache HTTP Server	<= 2.4.57

References

https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
https://lists.debian.org/debian-lts-announce/2024/05/msg00013.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TI3V2YCEUM65QDYPGGNUZ7UONIM5OEXC/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZJTT5TEFNSBWVMKCLS6EZ7PI6EJYBCO/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFDNHDH4VLFGDPY6MEZV2RO5N5FLFONW/Third Party Advisory
https://security.netapp.com/advisory/ntap-20231027-0011/Third Party Advisory
https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
https://lists.debian.org/debian-lts-announce/2024/05/msg00013.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TI3V2YCEUM65QDYPGGNUZ7UONIM5OEXC/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZJTT5TEFNSBWVMKCLS6EZ7PI6EJYBCO/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFDNHDH4VLFGDPY6MEZV2RO5N5FLFONW/Third Party Advisory
https://security.netapp.com/advisory/ntap-20231027-0011/Third Party Advisory

Timeline

Published: Oct 23, 2023
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-311239.1`effectindex/tripreporter` is a community-powered, universal platform for submitting and analyzing trip reports. Prior to commit bd80ba833b9 CVE-2023-311243.7c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be CVE-2023-311256.5Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught CVE-2023-311269.6`org.xwiki.commons:xwiki-commons-xml` is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in versi CVE-2023-311278.8libspdm is a sample implementation that follows the DMTF SPDM specifications. A vulnerability has been identified in SPDM session establishm CVE-2023-311288.8NextCloud Cookbook is a recipe library app. Prior to commit a46d9855 on the `master` branch and commit 489bb744 on the `main-0.9.x` branch, CVE-2023-311299.8The Contiki-NG operating system versions 4.8 and prior can be triggered to dereference a NULL pointer in the message handling code for IPv6 CVE-2023-31137.5An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could resul CVE-2023-311306.4c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particul CVE-2023-311319.1Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsaf CVE-2023-311327.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a privilege escalation vulne CVE-2023-311337.5Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to mem