CVE-2022-29404: Denial of service in mod_lua r:parsebody
A flaw was found in the modlua module of httpd. A malicious request to a Lua script that calls parsebody(0) can lead to a denial of service due to no default limit on the possible input size.
Other sources
In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-29404?
CVE-2022-29404 is a vulnerability in Apache HTTP Server 2.4.53 and earlier that can result in a denial of service due to a lack of input size limit.
How does CVE-2022-29404 affect Apache HTTP Server?
CVE-2022-29404 affects Apache HTTP Server versions 2.4.53 and earlier.
What is the severity of CVE-2022-29404?
CVE-2022-29404 has a severity rating of high with a severity value of 7.
How can I fix CVE-2022-29404?
To fix CVE-2022-29404, update Apache HTTP Server to version 2.4.54 or later.
Where can I find more information about CVE-2022-29404?
You can find more information about CVE-2022-29404 at the following references: [CVE-2022-29404](https://www.cve.org/CVERecord?id=CVE-2022-29404), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-29404), [Apache HTTP Server Security Vulnerabilities](https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-29404), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2095012), and [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2022:7647).