CVE-2022-24963: Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions
Vulnerability summary
CVE-2022-24963 is a critical (CVSS 9.8) Integer Overflow or Wraparound vulnerability in apache software foundation apache portable runtime (apr). EPSS estimates a 1.47% chance of exploitation in the next 30 days, higher than 73.8% of scored vulnerabilities.
Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2Timeline
- 31-01-2023PublishedVulnerability first disclosed.
- 27-03-2025Last modifiedVulnerability information updated.
Description
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.47%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.47% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat4 products
- apr< 0:1.7.0-12.el9_3
- apr-debuginfo< 0:1.7.0-12.el9_3
- apr-debugsource< 0:1.7.0-12.el9_3
- apr-devel< 0:1.7.0-12.el9_3
Alpine1 product
- apr< 1.7.1-r0
Apache1 product
- portable_runtime1.7.0
Apache software foundation1 product
Debian1 product
- apr< 1.7.0-6+deb11u2 | < 1.7.2-1
Mageia1 product
- apr< 1.7.2-1.mga8
Opensuse1 product
- apr&distro=openSUSE Tumbleweed< 1.7.2-1.1
Ubuntu1 product
- apr< 1.7.0-8ubuntu0.22.04.1
8 vendors · 11 products
