CVE-2022-22728: Apache LIBAPREQ2

High severity, CVSS 7.5. EPSS: 5.8% chance of exploitation in the next 30 days.

A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a request causing a process crash which could lead to a denial of service attack.

Affected products

• Apache LIBAPREQ2: up to and including 2.16
• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 35 only; version 36 only; version 37 only

Published 2022-08-25. Last modified 2026-06-17.