CVE-2022-22719: apache software foundation apache http server Improper Initialization
CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2022-22719UBUNTU-CVE-2022-22719DEBIAN-CVE-2022-22719
Published 14-03-2022Last modified 03-08-2024
Vulnerability summary
CVE-2022-22719 is a high (CVSS 7.5) Improper Initialization vulnerability in apache software foundation apache http server. EPSS estimates a 69.10% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
69.10%
0%100%
Critical · -0.71 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 14 · Related 9Timeline
- 14-03-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
69.10%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
-0.71 pp
From 69.80% on 18-09-2026
18-09-202618-10-2026
EPSS score69.10%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apple2 products
- mac_os_x10.15.7 | 10.15.7:security_update_2020-001 | 10.15.7:security_update_2021-001 | 10.15.7:security_update_2021-002 | 10.15.7:security_update_2021-003 | 10.15.7:security_update_2021-004 | 10.15.7:security_update_2021-005 | 10.15.7:security_update_2021-006 | 10.15.7:security_update_2021-007 | 10.15.7:security_update_2021-008 | 10.15.7:security_update_2022-001 | 10.15.7:security_update_2022-002 | 10.15.7:security_update_2022-003
- macos< 10.15.7 | ≥ 11.0, < 11.6.6 | ≥ 12.0.0, < 12.4
Debian2 products
- apache2< 2.4.53-1
- debian_linuxEOL9.0
Oracle2 products
- http_server12.2.1.3.0 | 12.2.1.4.0
- zfs_storage_appliance_kit8.8
Alpine1 product
- apache2< 2.4.53-r0
Apache1 product
- http_server≤ 2.4.52
Apache software foundation1 product
- apache http server≥ Apache HTTP Server 2.4, ≤ 2.4.52
Fedoraproject1 product
- fedoraEOL34 | 35 | 36
Ubuntu1 product
- apache2< 2.4.7-1ubuntu4.22+esm4 | < 2.4.18-2ubuntu3.17+esm5 | < 2.4.29-1ubuntu4.22 | < 2.4.41-4ubuntu3.10 | < 2.4.52-1ubuntu2
8 vendors · 11 products
References
22 links
lists.debian.org/debian-lts-announce/2022/03/msg00033.htmlMailing ListX Refsource MLISTThird Party Advisory
