Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-30522: Apache HTTP Server may crash on large data processing

CVE-2022-30522 · published 4 years ago

Summary

If Apache HTTP Server version 2.4.53 uses the mod_sed feature and receives very large input, it can consume too much memory and stop working. This can also affect systems that bundle Apache, such as NetApp clustered ONTAP, Fedora and Debian Apache packages. To prevent it, limit the size of data passed to mod_sed or apply the available configuration fix or upgrade.

What to do

Update debian apache2 to version 2.4.54-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	apache	http_server	2.4.53 `cpe:2.3:a:apache:http_server:2.4.53:::::::*`
–	netapp	clustered_data_ontap	All versions `cpe:2.3:a:netapp:clustered_data_ontap:-:::::::*`
–	fedoraproject	fedora	35 36 `cpe:2.3:o:fedoraproject:fedora:35:::::::*`
Debian:12	debian	apache2	< 2.4.54-1 Fix: upgrade to 2.4.54-1

Original advisory text

mod_sed denial of service

If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.

References

http://www.openwall.com/lists/oss-security/2022/06/08/6 Third Party Advisory
https://httpd.apache.org/security/vulnerabilities_24.html URL
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
https://security.gentoo.org/glsa/202208-20 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/30xxx/CVE-2022-30522... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-30522 Vendor Advisory
https://security.netapp.com/advisory/ntap-20220624-0005/ Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2022-30522 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

90% chance of attack within 30 days

Type

CWE-789Memory Allocation with Excessive Size Value

CWE-770Allocation of Resources Without Limits

Timeline

Published9 Jun 2022

Updated21 Oct 2026

First seen2 Apr 2026

Sources

CVE-2022-30522 · OSV

CVE-2022-30522 · NVD

DEBIAN-CVE-2022-30522 · OSV

Track software like this

Free during beta