CVE-2022-22720

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.(CVE-2022-23943)

If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.(CVE-2022-22721)

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling(CVE-2022-22720)

A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.(CVE-2022-22719)

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Errors encountered during the discarding of request body lead to HTTP request smuggling (CVE-2022-22720)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Errors encountered during the discarding of request body lead to HTTP request smuggling (CVE-2022-22720)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

• CVE-2022-22720: simpler connection close logic if discarding the request body fails
• CVE-2022-22721: make sure and check that LimitXMLRequestBody fits in system memory

• CVE-2022-22720: simpler connection close logic if discarding the request body fails
• CVE-2022-22721: make sure and check that LimitXMLRequestBody fits in system memory

• SECURITY UPDATE: mod_lua Use of uninitialized value of in r:parsebody
  • debian/patches/CVE-2022-22719.patch: refactor lua_read_body() in order to catch all possible errors
  • CVE-2022-22719
• SECURITY UPDATE: HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier
  • debian/patches/CVE-2022-22720.patch: simpler connection close logic if discarding the request body fails
  • CVE-2022-22720
• SECURITY UPDATE: Possible buffer overflow with very large or unlimited LimitXMLRequestBody
  • debian/patches/CVE-2022-22721.patch: make sure and check that LimitXMLRequestBody fits in system memory
  • CVE-2022-22721
• SECURITY UPDATE: mod_sed: Read/write beyond bounds
  • debian/patches/CVE-2022-23943.patch: use size_t to allow for larger buffer sizes and unsigned arithmetics and refactor logic flow of sed_write_output()
  • CVE-2022-23943 apache2 (1:2.4.18-2ubuntu3.17+tuxcare.els3) xenial-security; urgency=medium

• CVE-2022-22719: mod_lua: error out if lua_read_body() or lua_write_body() fail
• CVE-2022-22720: simpler connection close logic if discarding the request body fails
• CVE-2022-22721: make sure and check that LimitXMLRequestBody fits in system memory
• CVE-2022-23943: mod_sed: use size_t to allow for larger buffer sizes and unsigned arithmetics and refactor logic flow of sed_write_output() to avoid out-of-bounds write

• CVE-2022-22719: mod_lua: error out if lua_read_body() or lua_write_body() fail
• CVE-2022-22720: simpler connection close logic if discarding the request body fails
• CVE-2022-22721: make sure and check that LimitXMLRequestBody fits in system memory
• CVE-2022-23943: mod_sed: use size_t to allow for larger buffer sizes and unsigned arithmetics and refactor logic flow of set_write_output() to avoid out-of-bounds write

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds. Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. Credits: Ronald Crane (Zippenhop LLC)

SECURITY: CVE-2022-22721: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. Credits: Anonymous working with Trend Micro Zero Day Initiative

SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling Credits: James Kettle <james.kettle portswigger.net>

SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of in r:parsebody A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. Credits: Chamal De Silva

This update for apache2 fixes the following issues:

• CVE-2022-23943: heap out-of-bounds write in mod_sed (bsc#1197098).
• CVE-2022-22720: HTTP request smuggling due to incorrect error handling (bsc#1197095).
• CVE-2022-22719: use of uninitialized value of in r:parsebody in mod_lua (bsc#1197091).
• CVE-2022-22721: possible buffer overflow with very large or unlimited LimitXMLRequestBody (bsc#1197096).

These are all security issues fixed in the apache2-2.4.53-1.1 package on the GA media of openSUSE Tumbleweed.

This update for apache2 fixes the following issues:

• CVE-2022-23943: heap out-of-bounds write in mod_sed (bsc#1197098).
• CVE-2022-22720: HTTP request smuggling due to incorrect error handling (bsc#1197095).
• CVE-2022-22719: use of uninitialized value of in r:parsebody in mod_lua (bsc#1197091).
• CVE-2022-22721: possible buffer overflow with very large or unlimited LimitXMLRequestBody (bsc#1197096).

This update for apache2 fixes the following issues:

• CVE-2022-23943: heap out-of-bounds write in mod_sed (bsc#1197098).
• CVE-2022-22720: HTTP request smuggling due to incorrect error handling (bsc#1197095).
• CVE-2022-22719: use of uninitialized value of in r:parsebody in mod_lua (bsc#1197091).
• CVE-2022-22721: possible buffer overflow with very large or unlimited LimitXMLRequestBody (bsc#1197096).

Also TLS 1.3 support and openssl 1.1.1 usage was disabled again as it caused regressions in various usage scenarios due to the combination between openssl 1.0.2 and 1.1.1 linkage without correct symbol versions by other libraries / tools. (bsc#1197301 bsc#1197177 bsc#1196249)

This update for apache2 fixes the following issues:

• CVE-2022-23943: heap out-of-bounds write in mod_sed (bsc#1197098).
• CVE-2022-22720: HTTP request smuggling due to incorrect error handling (bsc#1197095).
• CVE-2022-22719: use of uninitialized value of in r:parsebody in mod_lua (bsc#1197091).
• CVE-2022-22721: possible buffer overflow with very large or unlimited LimitXMLRequestBody (bsc#1197096).

This update for apache2 fixes the following issues:

• CVE-2022-23943: heap out-of-bounds write in mod_sed (bsc#1197098).
• CVE-2022-22720: HTTP request smuggling due to incorrect error handling (bsc#1197095).
• CVE-2022-22719: use of uninitialized value of in r:parsebody in mod_lua (bsc#1197091).
• CVE-2022-22721: possible buffer overflow with very large or unlimited LimitXMLRequestBody (bsc#1197096).

This update for apache2 fixes the following issues:

• CVE-2022-22720: HTTP request smuggling due to incorrect error handling (bsc#1197095).
• CVE-2022-22721: possible buffer overflow with very large or unlimited LimitXMLRequestBody (bsc#1197096).

This update for apache2 fixes the following issues

• CVE-2026-23918: http2: double free and possible RCE on early reset (bsc#1263957).
• CVE-2026-24072: mod_rewrite elevation of privileges via ap_expr (bsc#1263935).
• CVE-2026-28780: heap buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (bsc#1264163).
• CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
• CVE-2026-29168: allocation of resources without limits in mod_md via OCSP response (bsc#1264150).
• CVE-2026-29169: NULL pointer dereference in mod_dav_lock allows server crash via malicious requests (bsc#1263956).
• CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
• CVE-2026-33006: mod_auth_digest timing attack allows bypass of Digest authentication (bsc#1263955).
• CVE-2026-33007: NULL pointer dereference in mod_authn_socache allows unauthenticated remote user to crash a child processes (bsc#1263954).
• CVE-2026-33523: HTTP response splitting forwarding malicious status line (bsc#1263953).
• CVE-2026-33857: off-by-one OOB reads in AJP getter functions (bsc#1263952).
• CVE-2026-34032: heap buffer overread in mod_proxy_ajp due to missing null-termination check (bsc#1263951).
• CVE-2026-34059: heap buffer overread and memory disclosure via ajp_parse_data() (bsc#1263950).
• CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
• CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
• CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
• CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
• CVE-2026-43951: out-of-bound read in merge_response_headers can cause crash (bsc#1267963).
• CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
• CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP send_request (bsc#1267969).
• CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of service (bsc#1267970).
• CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
• CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free (bsc#1267972).
• CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).

Non security issue:

• Update to 2.4.66 (jsc#PED-16334).

Chamal De Silva discovered that the Apache HTTP Server mod_lua module incorrectly handled certain crafted request bodies. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. (CVE-2022-22719)

James Kettle discovered that the Apache HTTP Server incorrectly closed inbound connection when certain errors are encountered. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. (CVE-2022-22720)

It was discovered that the Apache HTTP Server incorrectly handled large LimitXMLRequestBody settings on certain platforms. In certain configurations, a remote attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-22721)

Ronald Crane discovered that the Apache HTTP Server mod_sed module incorrectly handled memory. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-23943)

USN-5333-1 fixed several vulnerabilities in Apache. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

Chamal De Silva discovered that the Apache HTTP Server mod_lua module incorrectly handled certain crafted request bodies. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. (CVE-2022-22719)

James Kettle discovered that the Apache HTTP Server incorrectly closed inbound connection when certain errors are encountered. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. (CVE-2022-22720)

It was discovered that the Apache HTTP Server incorrectly handled large LimitXMLRequestBody settings on certain platforms. In certain configurations, a remote attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-22721)

Ronald Crane discovered that the Apache HTTP Server mod_sed module incorrectly handled memory. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-23943)