CVE-2022-28614

read beyond bounds via ap_rwrite()

The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.

We have discovered 1,158,978 live websites that are affected by CVE-2022-28614.

Run a Free Instant Scan



Affected Software

Product  Apache
Category Web Servers
Vulnerable Domains1,158,978 live websites (47% of Apache install base)
Vulnerable Versions
  • from 0 through 2.4.53
Vulnerable Versions Count106 versions ( 86% of all versions)


Common Weakness Enumeration

CWE-190 Integer Overflow or Wraparound



Details

  • Published - Jun 8, 2022
  • Updated - Aug 3, 2024

Credits

  • The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue

Website Distribution by Country

Number of websites using CVE-2022-28614
United States298,258 websites


Germany120,649 websites
Taiwan104,938 websites
Japan59,394 websites
France56,437 websites
Russia49,080 websites
Netherlands38,353 websites
Italy37,222 websites
Czech Republic32,220 websites
Poland24,236 websites

Website Distribution by TLD

Number of websites using CVE-2022-28614
.com460,806 websites
.de76,156 websites
.org48,040 websites
.net46,642 websites
.ru42,838 websites
.it32,281 websites
.nl28,640 websites
.cz26,406 websites
.jp23,811 websites
.pl20,755 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2022-28614

Top websites that are affected by CVE-2022-28614. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*************.***.****.****.************.net United States***
*****.***********.com Canada***
*********.net United States***
***.****.us United States*,***
***.*********.com Singapore*,***
*****.*******.com Singapore*,***
******************.com United States*,***
*******.**.com United States*,***
****.*********.net GB*,***
*********.******.net United States*,***
See full domain list

FAQ

CVE-2022-28614 is Integer Overflow or Wraparound in Apache
A total of 1,158,978 websites have been identified as vulnerable to CVE-2022-28614, based on global website indexing conducted by WebTechSurvey.
The Apache is affected by the CVE-2022-28614 vulnerability.
Apache versions up to and including 2.4.53 are vulnerable to CVE-2022-28614.