CVE-2022-24963
Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
- Record
CVE-2022-24963- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
CVE List
Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
- Record
CVE-2022-24963- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2022-29715
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
- Record
EUVD-2022-29715- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6rr3-mpxq-hv4x
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime ...
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
- Record
GHSA-6rr3-mpxq-hv4x- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-24963
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
- Record
ALPINE-CVE-2022-24963- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVAZL-13226
CVE-2022-24963 affecting package apr for versions less than 1.7.2-1
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
- Record
AZL-13226- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 19 moreShow less
OSVAZL-34546
CVE-2022-24963 affecting package apr for versions less than 1.7.2-1
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
- Record
AZL-34546- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSVBELL-CVE-2022-24963
CVE-2022-24963 does not affect BellSoft software
- Record
BELL-CVE-2022-24963- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
- Record
CVE-2022-24963- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-24963
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
- Record
DEBIAN-CVE-2022-24963- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVOESA-2023-1095
apr security update
The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.
Security Fix(es):
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.(CVE-2022-24963)
- Record
OESA-2023-1095- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2023-1096
apr security update
The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.
Security Fix(es):
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.(CVE-2022-24963)
- Record
OESA-2023-1096- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2023-1117
apr security update
The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.
Security Fix(es):
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.(CVE-2022-24963)
- Record
OESA-2023-1117- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2023-1118
apr security update
The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.
Security Fix(es):
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.(CVE-2022-24963)
- Record
OESA-2023-1118- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:4629
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 security update
- Record
RHSA-2023:4629- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2023:4909
Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.4 release and security update
- Record
RHSA-2023:4909- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2023:7711
Red Hat Security Advisory: apr security update
- Record
RHSA-2023:7711- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-24963
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
- Record
UBUNTU-CVE-2022-24963- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2023:7711 No score
Moderate: apr security update
The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other projects. It provides a free library of C data structures and routines.
Security Fix(es):
- apr: integer overflow/wraparound in apr_encode (CVE-2022-24963)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2023:7711- Updated
- 2026-11-02
OSVBIT-apr-2022-24963 No score
Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
- Record
BIT-apr-2022-24963- Updated
- 2026-11-02
OSVCLSA-2025-1762338135 No score
apr: Fix of CVE-2022-24963
- CVE-2022-24963: Fix integer overflow in apr_encode functions that could lead to out-of-bounds write
- Record
CLSA-2025-1762338135- Updated
- 2026-11-02
OSVMGASA-2023-0063 No score
Updated apr packages fix security vulnerability
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. (CVE-2022-24963)
- Record
MGASA-2023-0063- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12655-1 No score
apr-devel-1.7.2-1.1 on GA media
These are all security issues fixed in the apr-devel-1.7.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12655-1- Updated
- 2026-11-02
OSVRLSA-2023:7711 No score
Moderate: apr security update
The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other projects. It provides a free library of C data structures and routines.
Security Fix(es):
- apr: integer overflow/wraparound in apr_encode (CVE-2022-24963)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2023:7711- Updated
- 2026-11-02
OSVUSN-5885-1 No score
apr vulnerability
Ronald Crane discovered integer overflow vulnerabilities in the Apache Portable Runtime (APR) that could potentially result in memory corruption. A remote attacker could possibly use these issues to cause a denial of service or execute arbitary code.
- Record
USN-5885-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aprAlpine:v3.14 |
before 1.7.1-r0 | 1.7.1-r0 |
aprAlpine:v3.15 |
before 1.7.1-r0 | 1.7.1-r0 |
aprAlpine:v3.16 |
before 1.7.1-r0 | 1.7.1-r0 |
aprAlpine:v3.17 |
before 1.7.1-r0 | 1.7.1-r0 |
aprAlpine:v3.18 |
before 1.7.1-r0 | 1.7.1-r0 |
aprAlpine:v3.19 |
before 1.7.1-r0 | 1.7.1-r0 |
aprAlpine:v3.20 |
before 1.7.1-r0 | 1.7.1-r0 |
aprAlpine:v3.21 |
before 1.7.1-r0 | 1.7.1-r0 |
aprAlpine:v3.22 |
before 1.7.1-r0 | 1.7.1-r0 |
aprAlpine:v3.23 |
before 1.7.1-r0 | 1.7.1-r0 |
Show 106 moreShow less
| Package | Affected | Fixed |
|---|---|---|
aprAlpine:v3.24 |
before 1.7.1-r0 | 1.7.1-r0 |
aprAlmaLinux:9 |
before 1.7.0-12.el9_3 | 1.7.0-12.el9_3 |
apr-develAlmaLinux:9 |
before 1.7.0-12.el9_3 | 1.7.0-12.el9_3 |
aprAzure Linux:2 |
before 1.7.2-1 | 1.7.2-1 |
aprAzure Linux:3 |
before 1.7.2-1 | 1.7.2-1 |
aprBitnami |
1.7.0 up to 1.7.1 | 1.7.1 |
aprTuxCare:AlmaLinux:9.2 |
before 1.7.0-11.el9.tuxcare.els1 | 1.7.0-11.el9.tuxcare.els1 |
apr-develTuxCare:AlmaLinux:9.2 |
before 1.7.0-11.el9.tuxcare.els1 | 1.7.0-11.el9.tuxcare.els1 |
aprDebian:12 |
before 1.7.2-1 | 1.7.2-1 |
aprDebian:13 |
before 1.7.2-1 | 1.7.2-1 |
aprDebian:14 |
before 1.7.2-1 | 1.7.2-1 |
aprDebian:11 |
before 1.7.0-6+deb11u2, plus listed versions 1.7.0-61.7.0-6+deb11u1 |
1.7.0-6+deb11u2 |
aprMageia:8 |
before 1.7.2-1.mga8 | 1.7.2-1.mga8 |
apropenEuler:20.03-LTS-SP1 |
before 1.7.0-4.oe1 | 1.7.0-4.oe1 |
apropenEuler:20.03-LTS-SP3 |
before 1.7.0-5.oe1 | 1.7.0-5.oe1 |
apropenEuler:22.03-LTS-SP1 |
before 1.7.0-6.oe2203sp1 | 1.7.0-6.oe2203sp1 |
apropenEuler:22.03-LTS |
before 1.7.0-6.oe2203 | 1.7.0-6.oe2203 |
jbcs-httpd24-aprRed Hat:jboss_core_services:1::el7 |
before 0:1.7.0-8.el7jbcs | 0:1.7.0-8.el7jbcs |
jbcs-httpd24-apr-debuginfoRed Hat:jboss_core_services:1::el7 |
before 0:1.7.0-8.el7jbcs | 0:1.7.0-8.el7jbcs |
jbcs-httpd24-apr-develRed Hat:jboss_core_services:1::el7 |
before 0:1.7.0-8.el7jbcs | 0:1.7.0-8.el7jbcs |
jbcs-httpd24-aprRed Hat:jboss_core_services:1::el8 |
before 0:1.7.0-8.el8jbcs | 0:1.7.0-8.el8jbcs |
jbcs-httpd24-apr-debuginfoRed Hat:jboss_core_services:1::el8 |
before 0:1.7.0-8.el8jbcs | 0:1.7.0-8.el8jbcs |
jbcs-httpd24-apr-develRed Hat:jboss_core_services:1::el8 |
before 0:1.7.0-8.el8jbcs | 0:1.7.0-8.el8jbcs |
jbcs-httpd24-httpdRed Hat:jboss_core_services:1::el7 |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-httpd-debuginfoRed Hat:jboss_core_services:1::el7 |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-httpd-develRed Hat:jboss_core_services:1::el7 |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-httpd-manualRed Hat:jboss_core_services:1::el7 |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-httpd-selinuxRed Hat:jboss_core_services:1::el7 |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-httpd-toolsRed Hat:jboss_core_services:1::el7 |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-mod_ldapRed Hat:jboss_core_services:1::el7 |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-mod_proxy_htmlRed Hat:jboss_core_services:1::el7 |
before 1:2.4.57-5.el7jbcs | 1:2.4.57-5.el7jbcs |
jbcs-httpd24-mod_sessionRed Hat:jboss_core_services:1::el7 |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-mod_sslRed Hat:jboss_core_services:1::el7 |
before 1:2.4.57-5.el7jbcs | 1:2.4.57-5.el7jbcs |
jbcs-httpd24-httpdRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-debuginfoRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-develRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-manualRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-selinuxRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-toolsRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-tools-debuginfoRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_ldapRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_ldap-debuginfoRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_proxy_htmlRed Hat:jboss_core_services:1::el8 |
before 1:2.4.57-5.el8jbcs | 1:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_proxy_html-debuginfoRed Hat:jboss_core_services:1::el8 |
before 1:2.4.57-5.el8jbcs | 1:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_sessionRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_session-debuginfoRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_sslRed Hat:jboss_core_services:1::el8 |
before 1:2.4.57-5.el8jbcs | 1:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_ssl-debuginfoRed Hat:jboss_core_services:1::el8 |
before 1:2.4.57-5.el8jbcs | 1:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_securityRed Hat:jboss_core_services:1::el7 |
before 0:2.9.3-29.el7jbcs | 0:2.9.3-29.el7jbcs |
jbcs-httpd24-mod_security-debuginfoRed Hat:jboss_core_services:1::el7 |
before 0:2.9.3-29.el7jbcs | 0:2.9.3-29.el7jbcs |
jbcs-httpd24-mod_securityRed Hat:jboss_core_services:1::el8 |
before 0:2.9.3-29.el8jbcs | 0:2.9.3-29.el8jbcs |
jbcs-httpd24-mod_security-debuginfoRed Hat:jboss_core_services:1::el8 |
before 0:2.9.3-29.el8jbcs | 0:2.9.3-29.el8jbcs |
jbcs-httpd24-curlRed Hat:jboss_core_services:1::el7 |
before 0:8.2.1-1.el7jbcs | 0:8.2.1-1.el7jbcs |
jbcs-httpd24-curl-debuginfoRed Hat:jboss_core_services:1::el7 |
before 0:8.2.1-1.el7jbcs | 0:8.2.1-1.el7jbcs |
jbcs-httpd24-libcurlRed Hat:jboss_core_services:1::el7 |
before 0:8.2.1-1.el7jbcs | 0:8.2.1-1.el7jbcs |
jbcs-httpd24-libcurl-develRed Hat:jboss_core_services:1::el7 |
before 0:8.2.1-1.el7jbcs | 0:8.2.1-1.el7jbcs |
jbcs-httpd24-curlRed Hat:jboss_core_services:1::el8 |
before 0:8.2.1-1.el8jbcs | 0:8.2.1-1.el8jbcs |
jbcs-httpd24-curl-debuginfoRed Hat:jboss_core_services:1::el8 |
before 0:8.2.1-1.el8jbcs | 0:8.2.1-1.el8jbcs |
jbcs-httpd24-libcurlRed Hat:jboss_core_services:1::el8 |
before 0:8.2.1-1.el8jbcs | 0:8.2.1-1.el8jbcs |
jbcs-httpd24-libcurl-debuginfoRed Hat:jboss_core_services:1::el8 |
before 0:8.2.1-1.el8jbcs | 0:8.2.1-1.el8jbcs |
jbcs-httpd24-libcurl-develRed Hat:jboss_core_services:1::el8 |
before 0:8.2.1-1.el8jbcs | 0:8.2.1-1.el8jbcs |
jws5-tomcat-nativeRed Hat:jboss_enterprise_web_server:5.7::el7 |
before 0:1.2.31-15.redhat_15.el7jws | 0:1.2.31-15.redhat_15.el7jws |
jws5-tomcat-native-debuginfoRed Hat:jboss_enterprise_web_server:5.7::el7 |
before 0:1.2.31-15.redhat_15.el7jws | 0:1.2.31-15.redhat_15.el7jws |
jws5-tomcat-nativeRed Hat:jboss_enterprise_web_server:5.7::el8 |
before 0:1.2.31-15.redhat_15.el8jws | 0:1.2.31-15.redhat_15.el8jws |
jws5-tomcat-native-debuginfoRed Hat:jboss_enterprise_web_server:5.7::el8 |
before 0:1.2.31-15.redhat_15.el8jws | 0:1.2.31-15.redhat_15.el8jws |
jws5-tomcat-nativeRed Hat:jboss_enterprise_web_server:5.7::el9 |
before 0:1.2.31-15.redhat_15.el9jws | 0:1.2.31-15.redhat_15.el9jws |
jws5-tomcat-native-debuginfoRed Hat:jboss_enterprise_web_server:5.7::el9 |
before 0:1.2.31-15.redhat_15.el9jws | 0:1.2.31-15.redhat_15.el9jws |
jws5-tomcatRed Hat:jboss_enterprise_web_server:5.7::el7 |
before 0:9.0.62-15.redhat_00013.1.el7jws | 0:9.0.62-15.redhat_00013.1.el7jws |
jws5-tomcat-admin-webappsRed Hat:jboss_enterprise_web_server:5.7::el7 |
before 0:9.0.62-15.redhat_00013.1.el7jws | 0:9.0.62-15.redhat_00013.1.el7jws |
jws5-tomcat-docs-webappRed Hat:jboss_enterprise_web_server:5.7::el7 |
before 0:9.0.62-15.redhat_00013.1.el7jws | 0:9.0.62-15.redhat_00013.1.el7jws |
jws5-tomcat-el-3.0-apiRed Hat:jboss_enterprise_web_server:5.7::el7 |
before 0:9.0.62-15.redhat_00013.1.el7jws | 0:9.0.62-15.redhat_00013.1.el7jws |
jws5-tomcat-java-jdk11Red Hat:jboss_enterprise_web_server:5.7::el7 |
before 0:9.0.62-15.redhat_00013.1.el7jws | 0:9.0.62-15.redhat_00013.1.el7jws |
jws5-tomcat-java-jdk8Red Hat:jboss_enterprise_web_server:5.7::el7 |
before 0:9.0.62-15.redhat_00013.1.el7jws | 0:9.0.62-15.redhat_00013.1.el7jws |
jws5-tomcat-javadocRed Hat:jboss_enterprise_web_server:5.7::el7 |
before 0:9.0.62-15.redhat_00013.1.el7jws | 0:9.0.62-15.redhat_00013.1.el7jws |
jws5-tomcat-jsp-2.3-apiRed Hat:jboss_enterprise_web_server:5.7::el7 |
before 0:9.0.62-15.redhat_00013.1.el7jws | 0:9.0.62-15.redhat_00013.1.el7jws |
jws5-tomcat-libRed Hat:jboss_enterprise_web_server:5.7::el7 |
before 0:9.0.62-15.redhat_00013.1.el7jws | 0:9.0.62-15.redhat_00013.1.el7jws |
jws5-tomcat-selinuxRed Hat:jboss_enterprise_web_server:5.7::el7 |
before 0:9.0.62-15.redhat_00013.1.el7jws | 0:9.0.62-15.redhat_00013.1.el7jws |
jws5-tomcat-servlet-4.0-apiRed Hat:jboss_enterprise_web_server:5.7::el7 |
before 0:9.0.62-15.redhat_00013.1.el7jws | 0:9.0.62-15.redhat_00013.1.el7jws |
jws5-tomcat-webappsRed Hat:jboss_enterprise_web_server:5.7::el7 |
before 0:9.0.62-15.redhat_00013.1.el7jws | 0:9.0.62-15.redhat_00013.1.el7jws |
jws5-tomcatRed Hat:jboss_enterprise_web_server:5.7::el8 |
before 0:9.0.62-15.redhat_00013.1.el8jws | 0:9.0.62-15.redhat_00013.1.el8jws |
jws5-tomcat-admin-webappsRed Hat:jboss_enterprise_web_server:5.7::el8 |
before 0:9.0.62-15.redhat_00013.1.el8jws | 0:9.0.62-15.redhat_00013.1.el8jws |
jws5-tomcat-docs-webappRed Hat:jboss_enterprise_web_server:5.7::el8 |
before 0:9.0.62-15.redhat_00013.1.el8jws | 0:9.0.62-15.redhat_00013.1.el8jws |
jws5-tomcat-el-3.0-apiRed Hat:jboss_enterprise_web_server:5.7::el8 |
before 0:9.0.62-15.redhat_00013.1.el8jws | 0:9.0.62-15.redhat_00013.1.el8jws |
jws5-tomcat-javadocRed Hat:jboss_enterprise_web_server:5.7::el8 |
before 0:9.0.62-15.redhat_00013.1.el8jws | 0:9.0.62-15.redhat_00013.1.el8jws |
jws5-tomcat-jsp-2.3-apiRed Hat:jboss_enterprise_web_server:5.7::el8 |
before 0:9.0.62-15.redhat_00013.1.el8jws | 0:9.0.62-15.redhat_00013.1.el8jws |
jws5-tomcat-libRed Hat:jboss_enterprise_web_server:5.7::el8 |
before 0:9.0.62-15.redhat_00013.1.el8jws | 0:9.0.62-15.redhat_00013.1.el8jws |
jws5-tomcat-selinuxRed Hat:jboss_enterprise_web_server:5.7::el8 |
before 0:9.0.62-15.redhat_00013.1.el8jws | 0:9.0.62-15.redhat_00013.1.el8jws |
jws5-tomcat-servlet-4.0-apiRed Hat:jboss_enterprise_web_server:5.7::el8 |
before 0:9.0.62-15.redhat_00013.1.el8jws | 0:9.0.62-15.redhat_00013.1.el8jws |
jws5-tomcat-webappsRed Hat:jboss_enterprise_web_server:5.7::el8 |
before 0:9.0.62-15.redhat_00013.1.el8jws | 0:9.0.62-15.redhat_00013.1.el8jws |
jws5-tomcatRed Hat:jboss_enterprise_web_server:5.7::el9 |
before 0:9.0.62-15.redhat_00013.1.el9jws | 0:9.0.62-15.redhat_00013.1.el9jws |
jws5-tomcat-admin-webappsRed Hat:jboss_enterprise_web_server:5.7::el9 |
before 0:9.0.62-15.redhat_00013.1.el9jws | 0:9.0.62-15.redhat_00013.1.el9jws |
jws5-tomcat-docs-webappRed Hat:jboss_enterprise_web_server:5.7::el9 |
before 0:9.0.62-15.redhat_00013.1.el9jws | 0:9.0.62-15.redhat_00013.1.el9jws |
jws5-tomcat-el-3.0-apiRed Hat:jboss_enterprise_web_server:5.7::el9 |
before 0:9.0.62-15.redhat_00013.1.el9jws | 0:9.0.62-15.redhat_00013.1.el9jws |
jws5-tomcat-javadocRed Hat:jboss_enterprise_web_server:5.7::el9 |
before 0:9.0.62-15.redhat_00013.1.el9jws | 0:9.0.62-15.redhat_00013.1.el9jws |
jws5-tomcat-jsp-2.3-apiRed Hat:jboss_enterprise_web_server:5.7::el9 |
before 0:9.0.62-15.redhat_00013.1.el9jws | 0:9.0.62-15.redhat_00013.1.el9jws |
jws5-tomcat-libRed Hat:jboss_enterprise_web_server:5.7::el9 |
before 0:9.0.62-15.redhat_00013.1.el9jws | 0:9.0.62-15.redhat_00013.1.el9jws |
jws5-tomcat-selinuxRed Hat:jboss_enterprise_web_server:5.7::el9 |
before 0:9.0.62-15.redhat_00013.1.el9jws | 0:9.0.62-15.redhat_00013.1.el9jws |
jws5-tomcat-servlet-4.0-apiRed Hat:jboss_enterprise_web_server:5.7::el9 |
before 0:9.0.62-15.redhat_00013.1.el9jws | 0:9.0.62-15.redhat_00013.1.el9jws |
jws5-tomcat-webappsRed Hat:jboss_enterprise_web_server:5.7::el9 |
before 0:9.0.62-15.redhat_00013.1.el9jws | 0:9.0.62-15.redhat_00013.1.el9jws |
aprRed Hat:enterprise_linux:9::appstream |
before 0:1.7.0-12.el9_3 | 0:1.7.0-12.el9_3 |
apr-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:1.7.0-12.el9_3 | 0:1.7.0-12.el9_3 |
apr-debugsourceRed Hat:enterprise_linux:9::appstream |
before 0:1.7.0-12.el9_3 | 0:1.7.0-12.el9_3 |
apr-develRed Hat:enterprise_linux:9::appstream |
before 0:1.7.0-12.el9_3 | 0:1.7.0-12.el9_3 |
aprRocky Linux:9 |
before 0:1.7.0-12.el9_3 | 0:1.7.0-12.el9_3 |
aprUbuntu:22.04:LTS |
before 1.7.0-8ubuntu0.22.04.1, plus listed versions 1.7.0-6ubuntu11.7.0-81.7.0-8build1 |
1.7.0-8ubuntu0.22.04.1 |
apropenSUSE:Tumbleweed |
before 1.7.2-1.1 | 1.7.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24963 is a critical vulnerability (CVSS 9.8) in Apache Portable Runtime (apr), published January 31, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile. Fixed in apr 1.7.1-r0.
References
lists.apache.org/thread/fw9p6sdncwsjkstwc066vz57xqzfksq9
security.netapp.com/advisory/ntap-20230908-0008
nvd.nist.gov/vuln/detail/CVE-2022-24963
github.com/advisories/GHSA-6rr3-mpxq-hv4x
security.alpinelinux.org/vuln/CVE-2022-24963
access.redhat.com/errata/RHSA-2023:7711
Show 79 moreShow less
bugzilla.redhat.com/2169465
errata.almalinux.org/9/ALSA-2023-7711.html
docs.bell-sw.com/security/cves/CVE-2022-24963
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1762338135.html
security-tracker.debian.org/tracker/CVE-2022-24963
advisories.mageia.org/MGASA-2023-0063.html
bugs.mageia.org/show_bug.cgi?id=31485
openwall.com/lists/oss-security/2023/01/31/3
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1095
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4629.json
cve.org/CVERecord?id=CVE-2022-24963
httpd.apache.org/security/vulnerabilities_24.html
curl.se/docs/CVE-2023-28319.html
commons.apache.org/proper/commons-fileupload/security-reports.html
bz.apache.org/bugzilla/show_bug.cgi?id=66471
errata.rockylinux.org/RLSA-2023:7711
ubuntu.com/security/CVE-2022-24963
suse.com/security/cve/CVE-2022-24963