CVE-2022-22719: Apache HTTP Server crafted request body causes out-of-bounds read and crash

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote denial of service with a high EPSS score, though impact is limited to availability and no exploit or KEV listing is confirmed.

What it is

Apache HTTP Server 2.4.52 and earlier can read a random memory area when it processes a carefully crafted request body. The out-of-bounds read can crash the server process, giving an unauthenticated remote attacker a denial-of-service primitive against the web tier.

Impact

An attacker can crash the affected Apache process, disrupting service for all users of that server. The record describes only a read and crash, so no data disclosure or code execution is claimed.

Attack surface

Reachable over the network via HTTP by sending a crafted request body; the CVSS vector shows no privileges and no user interaction required. Any exposed Apache HTTP Server 2.4.52 or earlier endpoint that accepts request bodies is in scope.

Exploitation

Not listed in CISA KEV and no ransomware use documented, but EPSS is 0.698 (99.3rd percentile), indicating high predicted exploitation activity. References are vendor, distro and third-party advisories only, with no public exploit tag.

What to do

• Upgrade Apache HTTP Server to a version later than 2.4.52 per the vendor advisory.
• Apply the corresponding distro or vendor patches for Debian, Fedora, Oracle, Apple and NetApp builds where the bundled httpd is affected.
• If immediate patching is not possible, restrict or rate-limit untrusted request bodies at a reverse proxy or WAF.
• Monitor httpd child process crashes and restarts as an interim indicator until patched.

Detection

• Alert on repeated httpd child process crashes or unexpected worker restarts in server and system logs.
• Watch for HTTP requests with malformed or unusually large bodies targeting Apache endpoints.
• Correlate crash timestamps with source IPs in access logs to identify a single origin.
• Track EPSS and vendor advisories for this CVE to prioritize patching of internet-facing instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.