CVE-2022-29404: Apache HTTP Server

High severity, CVSS 7.5. EPSS: 6.4% chance of exploitation in the next 30 days.

In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.

Affected products

• Apache HTTP Server: up to and including 2.4.53
• Fedoraproject Fedora: version 35 only; version 36 only
• Netapp Clustered Data Ontap: affected versions not specified

Published 2022-06-09. Last modified 2026-06-17.