ALPINE-CVE-2022-28614 — Vulnetix

Try Vulnetix Request Demo

ALPINE-CVE-2022-28614 PUBLISHED CVSS 5.300000190734863 MEDIUM

The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.

Risk Scores

CVSS v3.1

5.300000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Products

Vendor	Product	Versions
Alpine:v3.19	apache2	2.2.17-r3, 2.2.17-r4, 2.2.20-r0
Alpine:v3.17	apache2	2.4.29-r1, 2.2.21-r1, 2.2.21-r2
Alpine:v3.13	apache2	2.4.38-r2, 2.4.38-r1, 2.4.38-r0
Alpine:v3.16	apache2	2.4.27-r2, 2.4.28-r0, 2.4.29-r0
Alpine:v3.22	apache2	2.4.17-r6, 2.4.9-r1, 2.4.9-r0
Alpine:v3.20	apache2	2.2.17-r1, 2.2.17-r3, 2.2.17-r4
Alpine:v3.18	apache2	2.2.21-r0, 2.2.21-r2, 2.2.21-r3
Alpine:v3.21	apache2	2.2.21-r2, 0, 2.2.16-r1
Alpine:v3.23	apache2	2.2.17-r4, 2.2.20-r0, 2.2.21-r0
Alpine:v3.14	apache2	2.4.29-r1, 2.4.9-r1, 2.4.9-r0
Alpine:v3.15	apache2	2.4.6-r1, 2.4.9-r1, 2.4.9-r0

Timeline

Jun 9, 2022 CVE Published
Dec 3, 2025 CVE Updated
Apr 30, 2026 Distribution Patch

References

https://security.alpinelinux.org/vuln/CVE-2022-28614 advisory

Open in Interactive Console →