{"id":"CVE-2022-28331","aliases":["ALPINE-CVE-2022-28331","BELL-CVE-2022-28331","BIT-apr-2022-28331","EUVD-2022-32783","GHSA-27j5-c395-8j82"],"status":"published","title":"Apache Portable Runtime (APR):  Windows out-of-bounds write in apr_socket_sendv function","description":"On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01575,"percentile":0.7562,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-787"],"published":"2023-01-31T15:55:21Z","modified":"2026-10-28T02:30:50Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"apr","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"apr","fixed_in":["1.7.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"apr","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.1"}]}]}],"products":[{"vendor":"apache","product":"apache portable runtime (apr)"},{"vendor":"apache","product":"portable_runtime"},{"vendor":"apache software foundation","product":"apache portable runtime (apr)"}],"references":[{"url":"https://lists.apache.org/thread/5pfdfn7h0vsdo5xzjn97vghp0x42jj2r","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28331","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-27j5-c395-8j82"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-28331","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-28331","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28331.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-28331","title":"Apache Portable Runtime (APR):  Windows out-of-bounds write in apr_socket_sendv function","description":"On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.","status":"published","published":"2023-01-31T15:55:21.488Z","modified":"2025-03-27T14:31:30.494Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:34:38.922686Z"}],"euvd":[{"id":"EUVD-2022-32783","description":"On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.","status":"published","published":"2023-01-31T15:55:21Z","modified":"2025-03-27T14:31:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:49.948923Z"}],"ghsa":[{"id":"GHSA-27j5-c395-8j82","title":"On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based...","description":"On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.","status":"published","published":"2023-01-31T18:30:22Z","modified":"2023-06-28T15:30:21Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-02T14:54:39.385813Z"}],"nvd":[{"id":"CVE-2022-28331","description":"On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.","status":"published","published":"2023-01-31T16:15:08.977Z","modified":"2026-06-17T04:38:24.12Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:07:35.561816Z"}],"osv":[{"id":"ALPINE-CVE-2022-28331","description":"On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.","status":"published","published":"2023-01-31T16:15:08.977Z","modified":"2026-11-03T07:18:33.149792354Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"BELL-CVE-2022-28331","title":"CVE-2022-28331 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:25.77328Z","modified":"2026-03-05T07:15:26.799106Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-28331","title":"Apache Portable Runtime (APR):  Windows out-of-bounds write in apr_socket_sendv function","description":"On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.","status":"published","published":"2023-01-31T15:55:21.488Z","modified":"2026-10-28T02:30:50.931106219Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"BIT-apr-2022-28331","title":"Apache Portable Runtime (APR):  Windows out-of-bounds write in apr_socket_sendv function","description":"On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.","status":"published","published":"2024-03-06T10:50:33.685Z","modified":"2026-09-08T08:45:45.623437993Z","updated_at":"2026-11-02T15:28:28.267217Z"}]}}