Apache LIBAPREQ2 vulnerabilities

3 CVEs affecting Apache LIBAPREQ2, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-22728, published 2022-08-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2006-0042, published 2006-02-18. Medium severity, CVSS 5.0. EPSS: 6.2% chance of exploitation in the next 30 days. Unspecified vulnerability in (1) apreq_parse_headers and (2) apreq_parse_urlencoded functions in Apache2::Request (Libapreq2) before 2.07 allows remote attackers to cause a denial of service (CPU…
CVE-2022-22728, published 2022-08-25. High severity, CVSS 7.5. EPSS: 5.8% chance of exploitation in the next 30 days. A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a request causing a process crash which could…
CVE-2019-12412, published 2020-11-19. High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days. A flaw in the libapreq2 v2.07 to v2.13 multipart parser can deference a null pointer leading to a process crash. A remote attacker could send a request causing a process crash which could lead to a…