https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T22:01:00.247460+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2022:7647 ALSA-2022:7647 — Moderate: httpd:2.4 security update 2026-10-02T22:01:00.278295+00:00

Affected: AlmaLinux:8: httpd, AlmaLinux:8: httpd-devel, AlmaLinux:8: httpd-filesystem, AlmaLinux:8: httpd-manual, AlmaLinux:8: httpd-tools, AlmaLinux:8: mod_http2, AlmaLinux:8: mod_ldap, AlmaLinux:8: mod_md, AlmaLinux:8: mod_proxy_html, AlmaLinux:8: mod_session and 1 more

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943) * httpd: mod_lua: Use of uninitialized value of in r:parsebody (CVE-2022-22719) * httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (CVE-2022-22721) * httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-26377) * httpd: mod_lua: DoS in r:parsebody (CVE-2022-29404) * httpd: mod_sed: DoS vulnerability (CVE-2022-30522) * httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism (CVE-2022-31813) * httpd: Out-of-bounds read via ap_rwrite() (CVE-2022-28614) * httpd: Out-of-bounds read in ap_strcmp_match() (CVE-2022-28615) * httpd: mod_lua: Information disclosure with websockets (CVE-2022-30556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/bdu:2022-01461 bdu:2022-01461 2026-10-02T22:01:00.278384+00:00 bdu:2022-01461 https://cve.radiocsirt.org/vuln/bell-cve-2022-23943 Withdrawn: BELL-CVE-2022-23943 — CVE-2022-23943 does not affect BellSoft software 2026-10-02T22:01:00.278402+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/bit-apache-2022-23943 BIT-apache-2022-23943 — mod_sed: Read/write beyond bounds 2026-10-02T22:01:00.278418+00:00

Affected: Bitnami: apache

Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.

 https://cve.radiocsirt.org/vuln/certfr-2022-avi-241 certfr-2022-avi-241 — De multiples vulnérabilités ont été découvertes dans Apache HTTP Server. Elles permettent à un attaquant de provoquer u… 2026-10-02T22:01:00.278443+00:00 certfr-2022-avi-241 https://cve.radiocsirt.org/vuln/cnvd-2022-41640 cnvd-2022-41640 2026-10-02T22:01:00.278460+00:00 cnvd-2022-41640 https://cve.radiocsirt.org/vuln/euvd-2026-13951 EUVD-2026-13951 2026-10-02T22:01:00.278472+00:00 EUVD-2026-13951 https://cve.radiocsirt.org/vuln/fkie_cve-2022-23943 fkie_cve-2022-23943 2026-10-02T22:01:00.278482+00:00

Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.

 https://cve.radiocsirt.org/vuln/ghsa-778r-vp3x-2f8c GHSA-778r-vp3x-2f8c 2026-10-02T22:01:00.278502+00:00

Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.

 https://cve.radiocsirt.org/vuln/gsd-2022-23943 gsd-2022-23943 2026-10-02T22:01:00.278516+00:00 gsd-2022-23943 https://cve.radiocsirt.org/vuln/icsa-22-132-02 ICSA-22-132-02 — Mitsubishi Electric MELSOFT iQ AppPortal 2026-10-02T22:01:00.278526+00:00

Apache HTTP Server Versions 2.4.0 to 2.4.46 allow unprivileged local users to stop httpd on Windows.CVE-2020-13938 has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). In Apache HTTP Server Versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow.CVE-2021-26691 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server Versions 2.4.48 and earlier.CVE-2021-34798 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). An attacker who can present SM2 content for decryption to an application could cause data to overflow the buffer up to a maximum of 62 bytes, altering the contents of other data held after the buffer or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1 (Affected 1.1.1-1.1.1k). This issue is detailed further in CVE-2021-3711.CVE-2021-3711 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A carefully crafted request body can ca…

 https://cve.radiocsirt.org/vuln/msrc_cve-2022-23943 msrc_CVE-2022-23943 — mod_sed: Read/write beyond bounds 2026-10-02T22:01:00.278567+00:00 msrc_CVE-2022-23943 https://cve.radiocsirt.org/vuln/oesa-2022-1596 OESA-2022-1596 — httpd security update 2026-10-02T22:01:00.278582+00:00

Affected: openEuler:20.03-LTS-SP1: httpd, openEuler:20.03-LTS-SP2: httpd, openEuler:20.03-LTS-SP3: httpd

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es): Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.(CVE-2022-23943) If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.(CVE-2022-22721) Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling(CVE-2022-22720) A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.(CVE-2022-22719)

 https://cve.radiocsirt.org/vuln/opensuse-su-2022:1031-1 openSUSE-SU-2022:1031-1 — Security update for apache2 2026-10-02T22:01:00.278610+00:00

Security update for apache2

 https://cve.radiocsirt.org/vuln/rhsa-2022:6753 RHSA-2022:6753 — Red Hat Security Advisory: httpd24-httpd security and bug fix update 2026-10-02T22:01:00.278627+00:00

httpd: Request splitting via HTTP/2 method injection and mod_proxy httpd: NULL pointer dereference via malformed requests httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path httpd: Out-of-bounds write in ap_escape_quotes() via malicious input httpd: possible NULL dereference or SSRF in forward proxy configurations httpd: mod_lua: Use of uninitialized value of in r:parsebody httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody httpd: mod_sed: Read/write beyond bounds httpd: mod_proxy_ajp: Possible request smuggling httpd: Out-of-bounds read via ap_rwrite() httpd: Out-of-bounds read in ap_strcmp_match() httpd: mod_lua: DoS in r:parsebody httpd: mod_sed: DoS vulnerability httpd: mod_lua: Information disclosure with websockets httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism

 https://cve.radiocsirt.org/vuln/suse-su-2022:0918-1 SUSE-SU-2022:0918-1 — Security update for apache2 2026-10-02T22:01:00.278666+00:00

Security update for apache2

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-23943 UBUNTU-CVE-2022-23943 2026-10-02T22:01:00.278682+00:00

Affected: Ubuntu:Pro:14.04:LTS: apache2, Ubuntu:Pro:16.04:LTS: apache2, Ubuntu:18.04:LTS: apache2, Ubuntu:20.04:LTS: apache2, Ubuntu:22.04:LTS: apache2

Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0302 WID-SEC-W-2022-0302 — Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administrator… 2026-10-02T22:01:00.278706+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.