CVE-2022-28615

Read beyond bounds in ap_strcmp_match()

Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.

We have discovered 1,197,300 live websites that are affected by CVE-2022-28615.

Run a Free Instant Scan



Affected Software

Product  Apache
Category Web Servers
Vulnerable Domains1,197,300 live websites (48% of Apache install base)
Vulnerable Versions
  • from 0 through 2.4.53
Vulnerable Versions Count106 versions ( 87% of all versions)


Common Weakness Enumeration

CWE-190 Integer Overflow or Wraparound



Details

  • Published - Jun 8, 2022
  • Updated - Dec 18, 2025

Credits

  • The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue

Website Distribution by Country

Number of websites using CVE-2022-28615
United States312,304 websites


Germany124,311 websites
Taiwan109,596 websites
Japan60,405 websites
France58,123 websites
Russia50,599 websites
Netherlands39,206 websites
Italy38,182 websites
Czech Republic32,766 websites
Singapore25,621 websites

Website Distribution by TLD

Number of websites using CVE-2022-28615
.com478,759 websites
.de78,550 websites
.org49,876 websites
.net47,895 websites
.ru44,185 websites
.it33,159 websites
.nl29,097 websites
.cz26,923 websites
.jp24,201 websites
.pl21,216 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2022-28615

Top websites that are affected by CVE-2022-28615. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*************.***.****.****.************.net United States***
*****.***********.com Canada***
*********.net United States***
***.****.us United States*,***
***.*********.com Singapore*,***
*****.*******.com Singapore*,***
******************.com United States*,***
*******.**.com United States*,***
****.*********.net GB*,***
*********.******.net United States*,***
See full domain list

FAQ

CVE-2022-28615 is Integer Overflow or Wraparound in Apache
A total of 1,197,300 websites have been identified as vulnerable to CVE-2022-28615, based on global website indexing conducted by WebTechSurvey.
The Apache is affected by the CVE-2022-28615 vulnerability.
Apache versions up to and including 2.4.53 are vulnerable to CVE-2022-28615.