CVE-2022-23943: Apache HTTP Server

Critical severity, CVSS 9.8. EPSS: 50.4% chance of exploitation in the next 30 days.

Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.

Affected products

• Apache HTTP Server: from 2.4.0, before 2.4.53 (fixed in 2.4.53)
• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 34 only; version 35 only; version 36 only
• Oracle HTTP Server: version 12.2.1.3.0 only; version 12.2.1.4.0 only
• Oracle ZFS Storage Appliance Kit: version 8.8 only

Published 2022-03-14. Last modified 2026-06-17.