mod_sed: Read/write beyond bounds
Published Mar 14, 2022
9.8
CRITICALCVSS 3.1
EPSS 50.40%
Description
Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.
Affected products
-
- Version 2.4StatusaffectedConstraints<=2.4.52
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server | n/a |
|
Configuration 1
- ≥ 2.4.0 · < 2.4.53
Configuration 2
- 34
- 35
- 36
Configuration 3
- 9.0
Configuration 4
- 12.2.1.3.0
- 12.2.1.4.0
- 8.8
No data.
JBoss Core Services for RHEL 8
jbcs-httpd24-httpd-0:2.4.51-37.el8jbcs
Fixed · RHSA-2022:8840
JBoss Core Services on RHEL 7
jbcs-httpd24-httpd-0:2.4.51-37.el7jbcs
Fixed · RHSA-2022:8840
Red Hat Enterprise Linux 8
httpd:2.4-8070020220725152258.3b9f49c4
Fixed · RHSA-2022:7647
Red Hat Enterprise Linux 9
httpd-0:2.4.53-7.el9
Fixed · RHSA-2022:8067
Red Hat Software Collections for Red Hat Enterprise Linux 7
httpd24-httpd-0:2.4.34-23.el7.5
Fixed · RHSA-2022:6753
Red Hat Enterprise Linux 6
httpd
Not affected
Red Hat Enterprise Linux 7
httpd
Out of support scope
Red Hat JBoss Enterprise Application Platform 6
httpd
Out of support scope
| Product | Package | State | Advisory |
|---|---|---|---|
| JBoss Core Services for RHEL 8 | jbcs-httpd24-httpd-0:2.4.51-37.el8jbcs | Fixed | RHSA-2022:8840 |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-httpd-0:2.4.51-37.el7jbcs | Fixed | RHSA-2022:8840 |
| Red Hat Enterprise Linux 8 | httpd:2.4-8070020220725152258.3b9f49c4 | Fixed | RHSA-2022:7647 |
| Red Hat Enterprise Linux 9 | httpd-0:2.4.53-7.el9 | Fixed | RHSA-2022:8067 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | httpd24-httpd-0:2.4.34-23.el7.5 | Fixed | RHSA-2022:6753 |
| Red Hat Enterprise Linux 6 | httpd | Not affected | n/a |
| Red Hat Enterprise Linux 7 | httpd | Out of support scope | n/a |
| Red Hat JBoss Enterprise Application Platform 6 | httpd | Out of support scope | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
The `mod_sed` module is disabled by default on Red Hat Enterprise Linux 7 and 8. For this reason, the flaw has been rated as having a security impact of Moderate. The httpd package as shipped with Red Hat Enterprise Linux 6 is not affected by this flaw because the `mod_sed` module is available only in httpd 2.3 and later.
Red Hat mitigation
Disabling mod_sed and restarting httpd will mitigate this flaw. See https://access.redhat.com/articles/10649 for more information.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1 other source (Red Hat) ▾
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
No CVSS v3.0 score for this CVE.
AV:N/AC:L/Au:N/C:P/I:P/A:P
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 4, 2026.
Score over time
2022-2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (75 key points)
Flat stretches are collapsed. Showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 4, 2026 | 50.40% (0.50401) | 98.88th | v5 (v2026.06.15) |
| Jun 15, 2026 | 50.40% (0.50401) | 98.77th | v5 (v2026.06.15) |
| Mar 25, 2026 | 60.55% (0.60552) | 98.26th | v4 (v2025.03.14) |
| Mar 4, 2026 | 59.43% (0.59430) | 98.20th | v4 (v2025.03.14) |
| Mar 2, 2026 | 39.70% (0.39705) | 97.25th | v4 (v2025.03.14) |
| Mar 1, 2026 | 46.26% (0.46258) | 97.60th | v4 (v2025.03.14) |
| Feb 10, 2026 | 65.56% (0.65560) | 98.45th | v4 (v2025.03.14) |
| Feb 4, 2026 | 67.60% (0.67604) | 98.53th | v4 (v2025.03.14) |
| Feb 1, 2026 | 43.13% (0.43129) | 97.41th | v4 (v2025.03.14) |
| Jan 4, 2026 | 68.55% (0.68553) | 98.55th | v4 (v2025.03.14) |
| Jan 1, 2026 | 50.67% (0.50674) | 97.76th | v4 (v2025.03.14) |
| Dec 28, 2025 | 68.55% (0.68553) | 98.55th | v4 (v2025.03.14) |
| Dec 27, 2025 | 66.90% (0.66901) | 98.50th | v4 (v2025.03.14) |
| Dec 4, 2025 | 68.55% (0.68553) | 98.54th | v4 (v2025.03.14) |
| Dec 1, 2025 | 50.67% (0.50674) | 97.73th | v4 (v2025.03.14) |
| Nov 21, 2025 | 68.55% (0.68553) | 98.53th | v4 (v2025.03.14) |
| Nov 18, 2025 | 77.03% (0.77030) | 99.04th | v4 (v2025.03.14) |
| Nov 4, 2025 | 68.55% (0.68553) | 98.53th | v4 (v2025.03.14) |
| Nov 1, 2025 | 47.28% (0.47278) | 97.57th | v4 (v2025.03.14) |
| Oct 28, 2025 | 65.91% (0.65905) | 98.42th | v4 (v2025.03.14) |
| Oct 27, 2025 | 64.14% (0.64142) | 98.35th | v4 (v2025.03.14) |
| Oct 4, 2025 | 65.91% (0.65905) | 98.45th | v4 (v2025.03.14) |
| Oct 1, 2025 | 47.28% (0.47278) | 97.62th | v4 (v2025.03.14) |
| Sep 4, 2025 | 64.14% (0.64142) | 98.38th | v4 (v2025.03.14) |
| Sep 1, 2025 | 38.58% (0.38580) | 97.17th | v4 (v2025.03.14) |
| Aug 4, 2025 | 64.14% (0.64142) | 98.35th | v4 (v2025.03.14) |
| Aug 1, 2025 | 38.58% (0.38580) | 97.14th | v4 (v2025.03.14) |
| Jul 30, 2025 | 64.14% (0.64142) | 98.34th | v4 (v2025.03.14) |
| Jul 4, 2025 | 65.91% (0.65905) | 98.40th | v4 (v2025.03.14) |
| Jul 1, 2025 | 47.28% (0.47278) | 97.56th | v4 (v2025.03.14) |
| Jun 25, 2025 | 65.91% (0.65905) | 98.39th | v4 (v2025.03.14) |
| Jun 24, 2025 | 74.26% (0.74257) | 98.76th | v4 (v2025.03.14) |
| Jun 4, 2025 | 65.91% (0.65905) | 98.38th | v4 (v2025.03.14) |
| Jun 1, 2025 | 47.87% (0.47868) | 97.58th | v4 (v2025.03.14) |
| May 24, 2025 | 66.38% (0.66376) | 98.41th | v4 (v2025.03.14) |
| May 4, 2025 | 68.53% (0.68529) | 98.49th | v4 (v2025.03.14) |
| May 1, 2025 | 47.28% (0.47278) | 97.53th | v4 (v2025.03.14) |
| Apr 23, 2025 | 68.53% (0.68529) | 98.49th | v4 (v2025.03.14) |
| Mar 30, 2025 | 71.00% (0.70998) | 98.61th | v4 (v2025.03.14) |
| Mar 29, 2025 | 81.66% (0.81662) | 98.96th | v4 (v2025.03.14) |
| Mar 25, 2025 | 71.00% (0.70998) | 98.64th | v4 (v2025.03.14) |
| Mar 24, 2025 | 69.53% (0.69531) | 98.57th | v4 (v2025.03.14) |
| Mar 23, 2025 | 73.43% (0.73428) | 98.71th | v4 (v2025.03.14) |
| Mar 17, 2025 | 68.61% (0.68608) | 98.51th | v4 (v2025.03.14) |
| Dec 17, 2024 | 17.41% (0.17408) | 96.09th | v3 (v2023.03.01) |
| Dec 12, 2024 | 13.74% (0.13736) | 95.85th | v3 (v2023.03.01) |
| Oct 18, 2024 | 12.81% (0.12813) | 95.61th | v3 (v2023.03.01) |
| May 21, 2024 | 10.44% (0.10438) | 94.98th | v3 (v2023.03.01) |
| Apr 23, 2024 | 12.02% (0.12015) | 95.28th | v3 (v2023.03.01) |
| Mar 27, 2024 | 15.09% (0.15087) | 95.69th | v3 (v2023.03.01) |
| Feb 27, 2024 | 19.89% (0.19895) | 96.19th | v3 (v2023.03.01) |
| Feb 11, 2024 | 18.60% (0.18599) | 96.04th | v3 (v2023.03.01) |
| Jan 1, 2024 | 19.09% (0.19086) | 95.79th | v3 (v2023.03.01) |
| Nov 8, 2023 | 18.59% (0.18592) | 95.69th | v3 (v2023.03.01) |
| Nov 3, 2023 | 73.18% (0.73182) | 97.76th | v3 (v2023.03.01) |
| Oct 20, 2023 | 75.25% (0.75251) | 97.80th | v3 (v2023.03.01) |
| Oct 5, 2023 | 78.02% (0.78019) | 97.86th | v3 (v2023.03.01) |
| Sep 22, 2023 | 78.84% (0.78837) | 97.87th | v3 (v2023.03.01) |
| Sep 7, 2023 | 80.53% (0.80526) | 97.90th | v3 (v2023.03.01) |
| Aug 25, 2023 | 79.37% (0.79373) | 97.86th | v3 (v2023.03.01) |
| Aug 12, 2023 | 79.28% (0.79279) | 97.85th | v3 (v2023.03.01) |
| Jul 16, 2023 | 77.63% (0.77626) | 97.78th | v3 (v2023.03.01) |
| Jun 19, 2023 | 76.26% (0.76259) | 97.72th | v3 (v2023.03.01) |
| Apr 28, 2023 | 78.75% (0.78753) | 97.73th | v3 (v2023.03.01) |
| Apr 16, 2023 | 76.95% (0.76955) | 97.67th | v3 (v2023.03.01) |
| Mar 21, 2023 | 77.47% (0.77471) | 97.65th | v3 (v2023.03.01) |
| Mar 7, 2023 | 72.41% (0.72412) | 97.48th | v3 (v2023.03.01) |
| Mar 6, 2023 | 3.03% (0.03032) | 83.64th | v2 (v2022.01.01) |
| Apr 20, 2022 | 3.03% (0.03032) | 82.08th | v2 (v2022.01.01) |
| Apr 9, 2022 | 1.86% (0.01859) | 75.21th | v2 (v2022.01.01) |
| Apr 1, 2022 | 1.74% (0.01742) | 74.10th | v2 (v2022.01.01) |
| Mar 26, 2022 | 1.74% (0.01742) | 54.24th | v2 (v2022.01.01) |
| Mar 23, 2022 | 1.25% (0.01246) | 42.05th | v2 (v2022.01.01) |
| Mar 22, 2022 | 0.95% (0.00954) | 17.37th | v2 (v2022.01.01) |
| Mar 15, 2022 | 0.89% (0.00885) | 11.38th | v2 (v2022.01.01) |
References (16)
- http://www.openwall.com/lists/oss-security/2022/03/14/1 mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-23943 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2064319 Issue Tracking
- https://httpd.apache.org/security/vulnerabilities_24.html x_refsource_MISCVendor Advisory
- https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-23943
- https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/ vendor-advisoryx_refsource_FEDORAThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/ vendor-advisoryx_refsource_FEDORAThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/ vendor-advisoryx_refsource_FEDORAThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-23943
- https://security.gentoo.org/glsa/202208-20 vendor-advisoryx_refsource_GENTOOThird Party Advisory
- https://security.netapp.com/advisory/ntap-20220321-0001/ x_refsource_CONFIRMThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-23943
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISCPatchThird Party Advisory
- https://www.tenable.com/security/tns-2022-08 x_refsource_CONFIRMThird Party Advisory
- https://www.tenable.com/security/tns-2022-09 x_refsource_CONFIRMThird Party Advisory
Change history (0)
No recorded changes yet.