CVE-2022-23943

—

CVSS 3.1

9.8 critical

EPSS

50%p99

Published

Mar 14, 2022 (Mar 14, 2022)

Modified

Jun 17, 2026

Description

Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.

Vendors: apache fedoraproject debian oracle
Products: http server, fedora, debian linux, zfs storage appliance kit
Weakness: CWE-190, CWE-787
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (50.4%)

In the news2 stories

QNAP Advises Users to Update NAS Firmware to Patch Apache HTTP Vulnerabilities

The Hacker NewsApr 22, 08:15 UTC · Apr 22, 2022Vulnerability CVE-2022-22721 CVE-2022-23943 CVE-2022-22719+3 CVEs

QNAP firmware updates fix Apache HTTP vulnerabilities in its NAS

Security AffairsApr 22, 11:28 UTC · Apr 22, 2022Vulnerability CVE-2022-22721 CVE-2022-23943 CVE-2022-22719+1 CVEs