Description
A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a request causing a process crash which could lead to a denial of service attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | libapreq2 | unspecified – ≤ 2.16 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | libapreq2 | 2.17-1 | — |
| Debian 10 | libapreq2 | 2.13-7~deb10u2 | DLA-3269-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libapreq2 | No fix yet | — |
| Ubuntu 26.04 LTS | libapreq2 | No fix yet | — |
| Ubuntu 25.10 | libapreq2 | No fix yet | — |
| Ubuntu 24.04 LTS | libapreq2 | No fix yet | — |
| Ubuntu 22.04 LTS | libapreq2 | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libapreq2 | No fix yet | — |
| Ubuntu 18.04 LTS | libapreq2 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | libapreq2 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | libapreq2 | No fix yet | — |
Advisories 1
- DLA-3269-1 libapreq2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://lists.apache.org/thread/2fsjoor96d47vtkpf76x4yo06nccvy1y
- [oss-security] 20220825 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [oss-security] 20220825 CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [oss-security] 20220826 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- FEDORA-2022-9e5046934e vendor-advisory
- FEDORA-2022-cf658a432f vendor-advisory
- FEDORA-2022-61f5b492b7 vendor-advisory
- [oss-security] 20221229 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [oss-security] 20221230 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [oss-security] 20221231 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [oss-security] 20221231 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [oss-security] 20230102 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [oss-security] 20230102 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [oss-security] 20230103 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption mailing-list
- [debian-lts-announce] 20230114 [SECURITY] [DLA 3269-1] libapreq2 security update mailing-list
- GLSA-202305-20 vendor-advisory