CVE-2022-30522: mod_sed denial of service
A flaw was found in the modsed module of httpd. A very large input to the modsed module can result in a denial of service due to excessively large memory allocations.
Other sources
Apache HTTP Server is vulnerable to a denial of service when configured to do transformations with modsed in contexts where the input to modsed may be very large. By making excessively large memory allocations, a remote attacker could exploit this vulnerability to trigger an abort.
— IBM
If Apache HTTP Server 2.4.53 is configured to do transformations with modsed in contexts where the input to modsed may be very large, modsed may make excessively large memory allocations and trigger an abort.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2022-30522.
What is the severity level of CVE-2022-30522?
The severity level of CVE-2022-30522 is high, with a severity value of 7.5.
Which software versions are affected by CVE-2022-30522?
The affected software versions are Apache HTTP Server 2.4.54, jbcs-httpd24-httpd 0:2.4.51-37.el8, jbcs-httpd24-httpd 0:2.4.51-37.el7, httpd 0:2.4.53-7.el9, and httpd24-httpd 0:2.4.34-23.el7.5.
How can this vulnerability be exploited?
This vulnerability can be exploited by a remote attacker by making excessively large memory allocations, leading to a denial of service.
Are there any remedies for CVE-2022-30522?
Yes, the remedy for CVE-2022-30522 is to update to Apache HTTP Server version 2.4.54.