{"id":"CVE-2022-24963","aliases":["ALPINE-CVE-2022-24963","ALSA-2023:7711","AZL-13226","AZL-34546","BELL-CVE-2022-24963","BIT-apr-2022-24963","CLSA-2025-1762338135","DEBIAN-CVE-2022-24963","DSA-5370-1","EUVD-2022-29715","GHSA-6rr3-mpxq-hv4x","MGASA-2023-0063","OESA-2023-1095","OESA-2023-1096","OESA-2023-1117","OESA-2023-1118","RHSA-2023:4629","RHSA-2023:4909","RHSA-2023:7711","RLSA-2023:7711","UBUNTU-CVE-2022-24963","USN-5885-1","openSUSE-SU-2024:12655-1"],"status":"published","title":"Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions","description":"Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer.\nThis issue affects Apache Portable Runtime (APR) version 1.7.0.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01513,"percentile":0.74848,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2023-01-31T15:52:09Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"apr","fixed_in":["1.7.0-12.el9_3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"apr-devel","fixed_in":["1.7.0-12.el9_3"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"apr","fixed_in":["1.7.2-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"apr","fixed_in":["1.7.2-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"apr","fixed_in":["1.7.1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"apr","fixed_in":["1.7.0-11.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"apr-devel","fixed_in":["1.7.0-11.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"apr","fixed_in":["1.7.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apr","fixed_in":["1.7.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apr","fixed_in":["1.7.2-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"apr","fixed_in":["1.7.0-6+deb11u2"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"apr","fixed_in":["1.7.2-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"apr","fixed_in":["1.7.0-4.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"apr","fixed_in":["1.7.0-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"apr","fixed_in":["1.7.0-6.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"apr","fixed_in":["1.7.0-6.oe2203"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr","fixed_in":["0:1.7.0-12.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-debuginfo","fixed_in":["0:1.7.0-12.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-debugsource","fixed_in":["0:1.7.0-12.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-devel","fixed_in":["0:1.7.0-12.el9_3"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"apr","fixed_in":["0:1.7.0-12.el9_3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"apr","fixed_in":["1.7.0-8ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"apr","fixed_in":["1.7.2-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-12.el9_3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"apr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-12.el9_3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"apr","ranges":[{"type":"SEMVER","events":[{"introduced":"1.7.0"},{"fixed":"1.7.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-11.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"apr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-11.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-6+deb11u2"}]}],"versions":["1.7.0-6","1.7.0-6+deb11u1"]},{"source":"osv","ecosystem":"Mageia:8","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-4.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-6.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-6.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-apr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-apr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-5.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-5.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-5.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-5.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.57-5.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-5.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.57-5.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-29.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-29.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-29.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.3-29.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.2.1-1.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.2.1-1.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.2.1-1.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.2.1-1.el7jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.2.1-1.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.2.1-1.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.2.1-1.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.2.1-1.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.2.1-1.el8jbcs"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-12.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-12.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-12.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-12.el9_3"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-12.el9_3"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-8ubuntu0.22.04.1"}]}],"versions":["1.7.0-6ubuntu1","1.7.0-8","1.7.0-8build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-8ubuntu0.22.04.1"}]}],"versions":["1.7.0-6ubuntu1","1.7.0-8","1.7.0-8build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-1.1"}]}]}],"products":[{"vendor":"apache","product":"apache portable runtime (apr)"},{"vendor":"apache","product":"portable_runtime"},{"vendor":"apache software foundation","product":"apache portable runtime (apr)"}],"references":[{"url":"https://lists.apache.org/thread/fw9p6sdncwsjkstwc066vz57xqzfksq9","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","article","report"]},{"url":"https://security.netapp.com/advisory/ntap-20230908-0008/","tags":["x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24963","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230908-0008"},{"url":"https://github.com/advisories/GHSA-6rr3-mpxq-hv4x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-24963","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7711","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24963","tags":["report"]},{"url":"https://bugzilla.redhat.com/2169465","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-7711.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-24963","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1762338135.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24963.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-24963","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0063.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31485","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/01/31/3","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1095","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1096","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1117","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1118","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:4629","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2161773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2161777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2163615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2163622","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2169465","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2176211","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196778","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196786","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196793","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4629.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24963","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-36760","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-36760","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36760","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-36760","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-37436","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-37436","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37436","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-37436","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-48279","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-48279","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48279","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24021","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24021","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24021","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27522","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27522","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27522","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28319","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28319","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-28319.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28321","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28321","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-28321.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28322","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-28322.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:4909","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172298","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2210321","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4909.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24998","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24998","tags":["advisory"]},{"url":"https://commons.apache.org/proper/commons-fileupload/security-reports.html#Fixed_in_Apache_Commons_FileUpload_1.5","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28708","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28708","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28708","tags":["advisory"]},{"url":"https://bz.apache.org/bugzilla/show_bug.cgi?id=66471","tags":["article"]},{"url":"https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28709","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28709","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28709","tags":["advisory"]},{"url":"https://lists.apache.org/thread/7wvxonzwb7k9hx9jt3q33cmy7j97jo3j","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7711.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:7711","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-24963","tags":["report"]},{"url":"https://github.com/apache/apr/commit/622905ddfa7b45dfca350e13442892de3c1f48e9","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5885-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24963","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-24963","title":"Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions","description":"Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer.\nThis issue affects Apache Portable Runtime (APR) version 1.7.0.","status":"published","published":"2023-01-31T15:52:09.716Z","modified":"2025-03-27T14:33:39.826Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:34:34.576287Z"}],"euvd":[{"id":"EUVD-2022-29715","description":"Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer.\nThis issue affects Apache Portable Runtime (APR) version 1.7.0.","status":"published","published":"2023-01-31T15:52:09Z","modified":"2025-03-27T14:33:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:49.948923Z"}],"ghsa":[{"id":"GHSA-6rr3-mpxq-hv4x","title":"Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime ...","description":"Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.","status":"published","published":"2023-01-31T18:30:22Z","modified":"2025-03-27T15:31:40Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:00:29.248113Z"}],"nvd":[{"id":"CVE-2022-24963","description":"Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer.\nThis issue affects Apache Portable Runtime (APR) version 1.7.0.","status":"published","published":"2023-01-31T16:15:08.83Z","modified":"2026-06-17T04:32:52.16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:07:35.561816Z"}],"osv":[{"id":"ALPINE-CVE-2022-24963","description":"Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer.\nThis issue affects Apache Portable Runtime (APR) version 1.7.0.","status":"published","published":"2023-01-31T16:15:08.83Z","modified":"2026-11-03T07:18:33.126617225Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"AZL-13226","title":"CVE-2022-24963 affecting package apr for versions less than 1.7.2-1","description":"Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer.\nThis issue affects Apache Portable Runtime (APR) version 1.7.0.","status":"published","published":"2023-01-31T16:15:08Z","modified":"2026-04-21T04:22:43.970473Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"AZL-34546","title":"CVE-2022-24963 affecting package apr for versions less than 1.7.2-1","description":"Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer.\nThis issue affects Apache Portable Runtime (APR) version 1.7.0.","status":"published","published":"2023-01-31T16:15:08Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T16:41:19.380321Z"},{"id":"BELL-CVE-2022-24963","title":"CVE-2022-24963 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:42.247983Z","modified":"2026-03-05T07:15:14.78447Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-24963","title":"Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions","description":"Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer.\nThis issue affects Apache Portable Runtime (APR) version 1.7.0.","status":"published","published":"2023-01-31T15:52:09.716Z","modified":"2026-10-28T02:30:40.160688734Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"DEBIAN-CVE-2022-24963","description":"Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.","status":"published","published":"2023-01-31T16:15:08.83Z","modified":"2026-11-03T08:02:15.131628861Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"OESA-2023-1095","title":"apr security update","description":"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.\r\n\r\nSecurity Fix(es):\r\n\r\nInteger Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.(CVE-2022-24963)","status":"published","published":"2023-02-17T11:05:34Z","modified":"2026-08-18T01:17:31.294047024Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1096","title":"apr security update","description":"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.\r\n\r\nSecurity Fix(es):\r\n\r\nInteger Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.(CVE-2022-24963)","status":"published","published":"2023-02-17T11:05:34Z","modified":"2026-08-18T01:17:31.448463375Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1117","title":"apr security update","description":"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.\r\n\r\nSecurity Fix(es):\r\n\r\nInteger Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.(CVE-2022-24963)","status":"published","published":"2023-02-24T11:05:35Z","modified":"2026-08-18T01:17:31.707069549Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1118","title":"apr security update","description":"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.\r\n\r\nSecurity Fix(es):\r\n\r\nInteger Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.(CVE-2022-24963)","status":"published","published":"2023-02-24T11:05:35Z","modified":"2026-08-18T01:17:31.615255853Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2023:4629","title":"Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 security update","status":"published","published":"2024-09-13T23:26:54Z","modified":"2026-09-21T10:05:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:4909","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.4 release and security update","status":"published","published":"2024-09-20T14:30:56Z","modified":"2026-10-08T10:03:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:7711","title":"Red Hat Security Advisory: apr security update","status":"published","published":"2024-09-13T23:28:22Z","modified":"2026-09-21T10:06:11Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"UBUNTU-CVE-2022-24963","description":"Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.","status":"published","published":"2023-01-31T16:15:00Z","modified":"2026-04-22T13:19:05.484414Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"ALSA-2023:7711","title":"Moderate: apr security update","description":"The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other projects. It provides a free library of C data structures and routines.\n\nSecurity Fix(es):\n\n* apr: integer overflow/wraparound in apr_encode (CVE-2022-24963)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-12-11T00:00:00Z","modified":"2026-10-29T11:31:35.900752862Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"BIT-apr-2022-24963","title":"Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions","description":"Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer.\nThis issue affects Apache Portable Runtime (APR) version 1.7.0.","status":"published","published":"2024-03-06T10:50:46.06Z","modified":"2026-09-08T08:45:47.197258154Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"CLSA-2025-1762338135","title":"apr: Fix of CVE-2022-24963","description":"- CVE-2022-24963: Fix integer overflow in apr_encode functions that could lead to\n  out-of-bounds write","status":"published","published":"2025-11-05T10:22:19Z","modified":"2026-06-01T00:31:19.963605961Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"DSA-5370-1","title":"apr - security update","status":"published","published":"2023-03-07T00:00:00Z","modified":"2026-03-09T02:10:48.173219Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2023-0063","title":"Updated apr packages fix security vulnerability","description":"Integer Overflow or Wraparound vulnerability in apr_encode functions of\nApache Portable Runtime (APR) allows an attacker to write beyond bounds\nof a buffer. (CVE-2022-24963)\n","status":"published","published":"2023-02-27T20:27:16Z","modified":"2026-04-16T04:43:14.359216762Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12655-1","title":"apr-devel-1.7.2-1.1 on GA media","description":"These are all security issues fixed in the apr-devel-1.7.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:41:25.408037Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"RLSA-2023:7711","title":"Moderate: apr security update","description":"The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other projects. It provides a free library of C data structures and routines.\n\nSecurity Fix(es):\n\n* apr: integer overflow/wraparound in apr_encode (CVE-2022-24963)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-05-10T14:33:09.148442Z","modified":"2025-10-09T05:47:17.514525Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"USN-5885-1","title":"apr vulnerability","description":"Ronald Crane discovered integer overflow vulnerabilities in the Apache\nPortable Runtime (APR) that could potentially result in memory corruption.\nA remote attacker could possibly use these issues to cause a denial of\nservice or execute arbitary code.\n\n","status":"published","published":"2023-02-27T00:45:53Z","modified":"2026-04-22T10:32:46.721606Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}