CVE-2022-28331: Apache Portable Runtime

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.

Affected products

• Apache Portable Runtime: up to and including 1.7.0

Published 2023-01-31. Last modified 2026-06-17.