Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/77452?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "type": "ebuild", "namespace": "www-servers", "name": "apache", "version": "2.4.54", "qualifiers": {}, "subpath": "", "is_vulnerable": false, "next_non_vulnerable_version": "2.4.56", "latest_non_vulnerable_version": "2.4.62", "affected_by_vulnerabilities": [], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3833?format=api", "vulnerability_id": "VCID-4d3t-es7p-9qhn", "summary": "Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-28615.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-28615.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-28615", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01111", "scoring_system": "epss", "scoring_elements": "0.78149", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.01111", "scoring_system": "epss", "scoring_elements": "0.78114", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.01111", "scoring_system": "epss", "scoring_elements": "0.78131", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.01111", "scoring_system": "epss", "scoring_elements": "0.78101", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.01111", "scoring_system": "epss", "scoring_elements": "0.78153", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.01111", "scoring_system": "epss", "scoring_elements": "0.78171", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.01111", "scoring_system": "epss", "scoring_elements": "0.78146", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.01111", "scoring_system": "epss", "scoring_elements": "0.7814", "published_at": "2026-04-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-28615" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28615", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28615" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012513", "reference_id": "1012513", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012513" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2095006", "reference_id": "2095006", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2095006" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/", "reference_id": "7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-18T15:26:06Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/06/08/9", "reference_id": "9", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-18T15:26:06Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2022/06/08/9" }, { "reference_url": "https://security.archlinux.org/AVG-2763", "reference_id": "AVG-2763", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2763" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2022-28615.json", "reference_id": "CVE-2022-28615", "reference_type": "", "scores": [ { "value": "low", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2022-28615.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-18T15:26:06Z/" } ], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20220624-0005/", "reference_id": "ntap-20220624-0005", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-18T15:26:06Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20220624-0005/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6753", "reference_id": "RHSA-2022:6753", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6753" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7647", "reference_id": "RHSA-2022:7647", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7647" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8067", "reference_id": "RHSA-2022:8067", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8067" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8840", "reference_id": "RHSA-2022:8840", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8840" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8841", "reference_id": "RHSA-2022:8841", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8841" }, { "reference_url": "https://usn.ubuntu.com/5487-1/", "reference_id": "USN-5487-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5487-1/" }, { "reference_url": "https://usn.ubuntu.com/5487-3/", "reference_id": "USN-5487-3", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5487-3/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/", "reference_id": "YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-18T15:26:06Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2022-28615" ], "risk_score": 4.1, "exploitability": "0.5", "weighted_severity": "8.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4d3t-es7p-9qhn" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3817?format=api", "vulnerability_id": "VCID-9u53-b79b-cfgd", "summary": "Malformed requests may cause the server to dereference a NULL pointer.\n\n\nThis issue affects Apache HTTP Server 2.4.48 and earlier.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-34798.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-34798.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-34798", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.1029", "scoring_system": "epss", "scoring_elements": "0.93141", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.1029", "scoring_system": "epss", "scoring_elements": "0.93171", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.1029", "scoring_system": "epss", "scoring_elements": "0.93166", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.1029", "scoring_system": "epss", "scoring_elements": "0.93172", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.1029", "scoring_system": "epss", "scoring_elements": "0.93169", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.1029", "scoring_system": "epss", "scoring_elements": "0.93151", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.1029", "scoring_system": "epss", "scoring_elements": "0.93154", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.1029", "scoring_system": "epss", "scoring_elements": "0.93153", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.1029", "scoring_system": "epss", "scoring_elements": "0.93162", "published_at": "2026-04-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-34798" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2005128", "reference_id": "2005128", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2005128" }, { "reference_url": "https://security.archlinux.org/AVG-2289", "reference_id": "AVG-2289", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2289" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2021-34798.json", "reference_id": "CVE-2021-34798", "reference_type": "", "scores": [ { "value": "moderate", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2021-34798.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:4613", "reference_id": "RHSA-2021:4613", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:4613" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:4614", "reference_id": "RHSA-2021:4614", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:4614" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0143", "reference_id": "RHSA-2022:0143", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0143" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0891", "reference_id": "RHSA-2022:0891", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0891" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6753", "reference_id": "RHSA-2022:6753", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6753" }, { "reference_url": "https://usn.ubuntu.com/5090-1/", "reference_id": "USN-5090-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5090-1/" }, { "reference_url": "https://usn.ubuntu.com/5090-2/", "reference_id": "USN-5090-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5090-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2021-34798" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9u53-b79b-cfgd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3824?format=api", "vulnerability_id": "VCID-cqjv-6m9n-mfeq", "summary": "A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery).\n\nThis issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-44224.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-44224.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-44224", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.1096", "scoring_system": "epss", "scoring_elements": "0.93382", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.1096", "scoring_system": "epss", "scoring_elements": "0.93414", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.1096", "scoring_system": "epss", "scoring_elements": "0.93409", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.1096", "scoring_system": "epss", "scoring_elements": "0.93415", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.1096", "scoring_system": "epss", "scoring_elements": "0.9339", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.1096", "scoring_system": "epss", "scoring_elements": "0.93398", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.1096", "scoring_system": "epss", "scoring_elements": "0.93406", "published_at": "2026-04-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-44224" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034672", "reference_id": "2034672", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034672" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2021-44224.json", "reference_id": "CVE-2021-44224", "reference_type": "", "scores": [ { "value": "moderate", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2021-44224.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1915", "reference_id": "RHSA-2022:1915", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1915" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6753", "reference_id": "RHSA-2022:6753", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6753" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7143", "reference_id": "RHSA-2022:7143", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7143" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7144", "reference_id": "RHSA-2022:7144", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7144" }, { "reference_url": "https://usn.ubuntu.com/5212-1/", "reference_id": "USN-5212-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5212-1/" }, { "reference_url": "https://usn.ubuntu.com/5212-2/", "reference_id": "USN-5212-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5212-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2021-44224" ], "risk_score": 3.2, "exploitability": "0.5", "weighted_severity": "6.4", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cqjv-6m9n-mfeq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3834?format=api", "vulnerability_id": "VCID-d36c-rrxh-ybgv", "summary": "In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29404.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29404.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-29404", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0232", "scoring_system": "epss", "scoring_elements": "0.84797", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.0232", "scoring_system": "epss", "scoring_elements": "0.84788", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.0232", "scoring_system": "epss", "scoring_elements": "0.84806", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.0232", "scoring_system": "epss", "scoring_elements": "0.84802", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.0232", "scoring_system": "epss", "scoring_elements": "0.84738", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.0232", "scoring_system": "epss", "scoring_elements": "0.84757", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.0232", "scoring_system": "epss", "scoring_elements": "0.84759", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.0232", "scoring_system": "epss", "scoring_elements": "0.84781", "published_at": "2026-04-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-29404" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29404", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29404" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012513", "reference_id": "1012513", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012513" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2095012", "reference_id": "2095012", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2095012" }, { "reference_url": "https://security.archlinux.org/AVG-2763", "reference_id": "AVG-2763", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2763" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2022-29404.json", "reference_id": "CVE-2022-29404", "reference_type": "", "scores": [ { "value": "low", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2022-29404.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6753", "reference_id": "RHSA-2022:6753", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6753" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7647", "reference_id": "RHSA-2022:7647", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7647" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8067", "reference_id": "RHSA-2022:8067", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8067" }, { "reference_url": "https://usn.ubuntu.com/5487-1/", "reference_id": "USN-5487-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5487-1/" }, { "reference_url": "https://usn.ubuntu.com/5487-3/", "reference_id": "USN-5487-3", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5487-3/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2022-29404" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-d36c-rrxh-ybgv" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3816?format=api", "vulnerability_id": "VCID-db6k-j9mj-e7hy", "summary": "A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning.\n\nThis issue affects Apache HTTP Server 2.4.17 to 2.4.48.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-33193.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-33193.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33193", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.72839", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.729", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.72879", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.72892", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.72917", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.72846", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.72866", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00739", "scoring_system": "epss", "scoring_elements": "0.72841", "published_at": "2026-04-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33193" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1966728", "reference_id": "1966728", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1966728" }, { "reference_url": "https://security.archlinux.org/AVG-2289", "reference_id": "AVG-2289", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2289" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2021-33193.json", "reference_id": "CVE-2021-33193", "reference_type": "", "scores": [ { "value": "moderate", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2021-33193.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1915", "reference_id": "RHSA-2022:1915", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1915" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6753", "reference_id": "RHSA-2022:6753", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6753" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7143", "reference_id": "RHSA-2022:7143", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7143" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7144", "reference_id": "RHSA-2022:7144", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7144" }, { "reference_url": "https://usn.ubuntu.com/5090-1/", "reference_id": "USN-5090-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5090-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2021-33193" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-db6k-j9mj-e7hy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3822?format=api", "vulnerability_id": "VCID-ffpe-1ctd-77e9", "summary": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives.\n\nIf files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution.\n\nThis issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and not earlier versions.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41773.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41773.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-41773", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.94391", "scoring_system": "epss", "scoring_elements": "0.99973", "published_at": "2026-04-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-41773" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/07/1", "reference_id": "1", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/07/1" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/08/1", "reference_id": "1", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/08/1" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/09/1", "reference_id": "1", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/09/1" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/16/1", "reference_id": "1", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/16/1" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/05/2", "reference_id": "2", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/05/2" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/08/2", "reference_id": "2", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/08/2" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2010757", "reference_id": "2010757", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2010757" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/08/3", "reference_id": "3", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/08/3" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/15/3", "reference_id": "3", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/15/3" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/08/4", "reference_id": "4", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/08/4" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/11/4", "reference_id": "4", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/11/4" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/08/5", "reference_id": "5", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/08/5" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/07/6", "reference_id": "6", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/07/6" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/08/6", "reference_id": "6", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/08/6" }, { "reference_url": "http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html", "reference_id": "Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html" }, { "reference_url": "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "reference_id": "Apache-HTTP-Server-2.4.49-Path-Traversal.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html" }, { "reference_url": "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html", "reference_id": "Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html" }, { "reference_url": "http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html", "reference_id": "Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html" }, { "reference_url": "https://security.archlinux.org/AVG-2442", "reference_id": "AVG-2442", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2442" }, { "reference_url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "reference_id": "cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ" }, { "reference_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/50383.sh", "reference_id": "CVE-2021-41773", "reference_type": "exploit", "scores": [], "url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/50383.sh" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2021-41773.json", "reference_id": "CVE-2021-41773", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2021-41773.json" }, { "reference_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/50512.py", "reference_id": "CVE-2021-42013;CVE-2021-41773", "reference_type": "exploit", "scores": [], "url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/50512.py" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20211029-0009/", "reference_id": "ntap-20211029-0009", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20211029-0009/" }, { "reference_url": "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E", "reference_id": "r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f%40%3Cusers.httpd.apache.org%3E", "reference_id": "r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f%40%3Cusers.httpd.apache.org%3E", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f%40%3Cusers.httpd.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E", "reference_id": "r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3E", "reference_id": "r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3E", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E", "reference_id": "rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "reference_id": "RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/", "reference_id": "WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:41:10Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2021-41773" ], "risk_score": 10.0, "exploitability": "2.0", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ffpe-1ctd-77e9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3829?format=api", "vulnerability_id": "VCID-g55m-t4s1-nfhv", "summary": "Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data.\n\nThis issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23943.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23943.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-23943", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.60552", "scoring_system": "epss", "scoring_elements": "0.98286", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.60552", "scoring_system": "epss", "scoring_elements": "0.98284", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.60552", "scoring_system": "epss", "scoring_elements": "0.98285", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.60552", "scoring_system": "epss", "scoring_elements": "0.98273", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.60552", "scoring_system": "epss", "scoring_elements": "0.98275", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.60552", "scoring_system": "epss", "scoring_elements": "0.9828", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.60552", "scoring_system": "epss", "scoring_elements": "0.98281", "published_at": "2026-04-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-23943" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23943", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23943" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064319", "reference_id": "2064319", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064319" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2022-23943.json", "reference_id": "CVE-2022-23943", "reference_type": "", "scores": [ { "value": "important", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2022-23943.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6753", "reference_id": "RHSA-2022:6753", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6753" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7647", "reference_id": "RHSA-2022:7647", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7647" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8067", "reference_id": "RHSA-2022:8067", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8067" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8840", "reference_id": "RHSA-2022:8840", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8840" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8841", "reference_id": "RHSA-2022:8841", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8841" }, { "reference_url": "https://usn.ubuntu.com/5333-1/", "reference_id": "USN-5333-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5333-1/" }, { "reference_url": "https://usn.ubuntu.com/5333-2/", "reference_id": "USN-5333-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5333-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2022-23943" ], "risk_score": 3.6, "exploitability": "0.5", "weighted_severity": "7.3", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-g55m-t4s1-nfhv" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3835?format=api", "vulnerability_id": "VCID-gv84-vfvh-y7hu", "summary": "If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30522.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30522.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30522", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.11589", "scoring_system": "epss", "scoring_elements": "0.93644", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.11589", "scoring_system": "epss", "scoring_elements": "0.93636", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.11589", "scoring_system": "epss", "scoring_elements": "0.93638", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.11589", "scoring_system": "epss", "scoring_elements": "0.93643", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.11589", "scoring_system": "epss", "scoring_elements": "0.93616", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.11589", "scoring_system": "epss", "scoring_elements": "0.93625", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.11589", "scoring_system": "epss", "scoring_elements": "0.93627", "published_at": "2026-04-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30522" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30522", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30522" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012513", "reference_id": "1012513", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012513" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2095015", "reference_id": "2095015", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2095015" }, { "reference_url": "https://security.archlinux.org/AVG-2763", "reference_id": "AVG-2763", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2763" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2022-30522.json", "reference_id": "CVE-2022-30522", "reference_type": "", "scores": [ { "value": "low", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2022-30522.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6753", "reference_id": "RHSA-2022:6753", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6753" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7647", "reference_id": "RHSA-2022:7647", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7647" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8067", "reference_id": "RHSA-2022:8067", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8067" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8840", "reference_id": "RHSA-2022:8840", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8840" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8841", "reference_id": "RHSA-2022:8841", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8841" }, { "reference_url": "https://usn.ubuntu.com/5487-1/", "reference_id": "USN-5487-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5487-1/" }, { "reference_url": "https://usn.ubuntu.com/5487-3/", "reference_id": "USN-5487-3", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5487-3/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2022-30522" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gv84-vfvh-y7hu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3821?format=api", "vulnerability_id": "VCID-hj5r-jms3-x3fe", "summary": "While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing,\nallowing an external source to DoS the server. This requires a specially crafted request. \n\nThe vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41524.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41524.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-41524", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.07103", "scoring_system": "epss", "scoring_elements": "0.91488", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.07103", "scoring_system": "epss", "scoring_elements": "0.91533", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.07103", "scoring_system": "epss", "scoring_elements": "0.91534", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.07103", "scoring_system": "epss", "scoring_elements": "0.91535", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.07103", "scoring_system": "epss", "scoring_elements": "0.91495", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.07103", "scoring_system": "epss", "scoring_elements": "0.91502", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.07103", "scoring_system": "epss", "scoring_elements": "0.9151", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.07103", "scoring_system": "epss", "scoring_elements": "0.91523", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.07103", "scoring_system": "epss", "scoring_elements": "0.91529", "published_at": "2026-04-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-41524" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2010934", "reference_id": "2010934", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2010934" }, { "reference_url": "https://security.archlinux.org/AVG-2442", "reference_id": "AVG-2442", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2442" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2021-41524.json", "reference_id": "CVE-2021-41524", "reference_type": "", "scores": [ { "value": "moderate", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2021-41524.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7143", "reference_id": "RHSA-2022:7143", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7143" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7144", "reference_id": "RHSA-2022:7144", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7144" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2021-41524" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-hj5r-jms3-x3fe" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3836?format=api", "vulnerability_id": "VCID-hm3f-m22n-u3gy", "summary": "Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30556.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30556.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30556", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00506", "scoring_system": "epss", "scoring_elements": "0.66229", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00506", "scoring_system": "epss", "scoring_elements": "0.66253", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00506", "scoring_system": "epss", "scoring_elements": "0.66273", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00506", "scoring_system": "epss", "scoring_elements": "0.6626", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00506", "scoring_system": "epss", "scoring_elements": "0.66195", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00506", "scoring_system": "epss", "scoring_elements": "0.66222", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00506", "scoring_system": "epss", "scoring_elements": "0.66192", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00506", "scoring_system": "epss", "scoring_elements": "0.6624", "published_at": "2026-04-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30556" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30556", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30556" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012513", "reference_id": "1012513", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012513" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2095018", "reference_id": "2095018", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2095018" }, { "reference_url": "https://security.archlinux.org/AVG-2763", "reference_id": "AVG-2763", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2763" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2022-30556.json", "reference_id": "CVE-2022-30556", "reference_type": "", "scores": [ { "value": "low", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2022-30556.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6753", "reference_id": "RHSA-2022:6753", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6753" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7647", "reference_id": "RHSA-2022:7647", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7647" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8067", "reference_id": "RHSA-2022:8067", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8067" }, { "reference_url": "https://usn.ubuntu.com/5487-1/", "reference_id": "USN-5487-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5487-1/" }, { "reference_url": "https://usn.ubuntu.com/5487-3/", "reference_id": "USN-5487-3", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5487-3/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2022-30556" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-hm3f-m22n-u3gy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3827?format=api", "vulnerability_id": "VCID-k4nk-qqxg-s7e6", "summary": "Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22720.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22720.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-22720", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.27458", "scoring_system": "epss", "scoring_elements": "0.96418", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.27458", "scoring_system": "epss", "scoring_elements": "0.96414", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.27458", "scoring_system": "epss", "scoring_elements": "0.96415", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.27458", "scoring_system": "epss", "scoring_elements": "0.9639", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.27458", "scoring_system": "epss", "scoring_elements": "0.96395", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.27458", "scoring_system": "epss", "scoring_elements": "0.96398", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.27458", "scoring_system": "epss", "scoring_elements": "0.96407", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.27458", "scoring_system": "epss", "scoring_elements": "0.96409", "published_at": "2026-04-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-22720" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22720", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22720" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064321", "reference_id": "2064321", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064321" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2022-22720.json", "reference_id": "CVE-2022-22720", "reference_type": "", "scores": [ { "value": "important", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2022-22720.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1045", "reference_id": "RHSA-2022:1045", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1045" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1049", "reference_id": "RHSA-2022:1049", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1049" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1072", "reference_id": "RHSA-2022:1072", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1072" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1075", "reference_id": "RHSA-2022:1075", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1075" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1080", "reference_id": "RHSA-2022:1080", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1080" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1102", "reference_id": "RHSA-2022:1102", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1102" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1136", "reference_id": "RHSA-2022:1136", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1136" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1137", "reference_id": "RHSA-2022:1137", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1137" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1138", "reference_id": "RHSA-2022:1138", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1138" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1139", "reference_id": "RHSA-2022:1139", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1139" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1173", "reference_id": "RHSA-2022:1173", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1173" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1389", "reference_id": "RHSA-2022:1389", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1389" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1390", "reference_id": "RHSA-2022:1390", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1390" }, { "reference_url": "https://usn.ubuntu.com/5333-1/", "reference_id": "USN-5333-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5333-1/" }, { "reference_url": "https://usn.ubuntu.com/5333-2/", "reference_id": "USN-5333-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5333-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2022-22720" ], "risk_score": 3.8, "exploitability": "0.5", "weighted_severity": "7.5", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-k4nk-qqxg-s7e6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3820?format=api", "vulnerability_id": "VCID-mtg7-8556-kbgd", "summary": "A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.\n\nThis issue affects Apache HTTP Server 2.4.48 and earlier.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-40438.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-40438.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-40438", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.94432", "scoring_system": "epss", "scoring_elements": "0.99985", "published_at": "2026-04-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-40438" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2005117", "reference_id": "2005117", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2005117" }, { "reference_url": "https://security.archlinux.org/AVG-2289", "reference_id": "AVG-2289", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2289" }, { "reference_url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ", "reference_id": "cisco-sa-apache-httpd-2.4.49-VWL69sWQ", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "value": "Attend", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:08:29Z/" } ], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2021-40438.json", "reference_id": "CVE-2021-40438", "reference_type": "", "scores": [ { "value": "important", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2021-40438.json" }, { "reference_url": "https://www.debian.org/security/2021/dsa-4982", "reference_id": "dsa-4982", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "value": "Attend", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:08:29Z/" } ], "url": "https://www.debian.org/security/2021/dsa-4982" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "value": "Attend", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:08:29Z/" } ], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html", "reference_id": "msg00001.html", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "value": "Attend", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:08:29Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20211008-0004/", "reference_id": "ntap-20211008-0004", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "value": "Attend", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:08:29Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20211008-0004/" }, { "reference_url": "https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E", "reference_id": "r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "value": "Attend", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:08:29Z/" } ], "url": "https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E", "reference_id": "r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "value": "Attend", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:08:29Z/" } ], "url": "https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E", "reference_id": "r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "value": "Attend", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:08:29Z/" } ], "url": "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E", "reference_id": "r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "value": "Attend", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:08:29Z/" } ], "url": "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E", "reference_id": "r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "value": "Attend", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:08:29Z/" } ], "url": "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E", "reference_id": "r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "value": "Attend", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:08:29Z/" } ], "url": "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E", "reference_id": "rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "value": "Attend", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:08:29Z/" } ], "url": "https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3745", "reference_id": "RHSA-2021:3745", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3745" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3746", "reference_id": "RHSA-2021:3746", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3746" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3754", "reference_id": "RHSA-2021:3754", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3754" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3816", "reference_id": "RHSA-2021:3816", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3816" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3836", "reference_id": "RHSA-2021:3836", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3836" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3837", "reference_id": "RHSA-2021:3837", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3837" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3856", "reference_id": "RHSA-2021:3856", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3856" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/", "reference_id": "SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "value": "Attend", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:08:29Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/" }, { "reference_url": "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf", "reference_id": "ssa-685781.pdf", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "value": "Attend", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:08:29Z/" } ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf" }, { "reference_url": "https://www.tenable.com/security/tns-2021-17", "reference_id": "tns-2021-17", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "value": "Attend", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:08:29Z/" } ], "url": "https://www.tenable.com/security/tns-2021-17" }, { "reference_url": "https://usn.ubuntu.com/5090-1/", "reference_id": "USN-5090-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5090-1/" }, { "reference_url": "https://usn.ubuntu.com/5090-2/", "reference_id": "USN-5090-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5090-2/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/", "reference_id": "ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "value": "Attend", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:08:29Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2021-40438" ], "risk_score": 10.0, "exploitability": "2.0", "weighted_severity": "8.1", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-mtg7-8556-kbgd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3832?format=api", "vulnerability_id": "VCID-na94-5565-dyfc", "summary": "The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function.\n\nModules compiled and distributed separately from Apache HTTP Server that use the \"ap_rputs\" function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-28614.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-28614.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-28614", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00593", "scoring_system": "epss", "scoring_elements": "0.69266", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00593", "scoring_system": "epss", "scoring_elements": "0.69289", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00593", "scoring_system": "epss", "scoring_elements": "0.69311", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00593", "scoring_system": "epss", "scoring_elements": "0.69295", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00593", "scoring_system": "epss", "scoring_elements": "0.6922", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00593", "scoring_system": "epss", "scoring_elements": "0.6924", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00593", "scoring_system": "epss", "scoring_elements": "0.69221", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00593", "scoring_system": "epss", "scoring_elements": "0.69271", "published_at": "2026-04-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-28614" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28614", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28614" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012513", "reference_id": "1012513", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012513" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2095002", "reference_id": "2095002", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2095002" }, { "reference_url": "https://security.archlinux.org/AVG-2763", "reference_id": "AVG-2763", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2763" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2022-28614.json", "reference_id": "CVE-2022-28614", "reference_type": "", "scores": [ { "value": "low", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2022-28614.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6753", "reference_id": "RHSA-2022:6753", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6753" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7647", "reference_id": "RHSA-2022:7647", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7647" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8067", "reference_id": "RHSA-2022:8067", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8067" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8840", "reference_id": "RHSA-2022:8840", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8840" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8841", "reference_id": "RHSA-2022:8841", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8841" }, { "reference_url": "https://usn.ubuntu.com/5487-1/", "reference_id": "USN-5487-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5487-1/" }, { "reference_url": "https://usn.ubuntu.com/5487-3/", "reference_id": "USN-5487-3", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5487-3/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2022-28614" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-na94-5565-dyfc" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3837?format=api", "vulnerability_id": "VCID-p2a1-afnh-7qca", "summary": "Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism.\nThis may be used to bypass IP based authentication on the origin server/application.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-31813.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-31813.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-31813", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00038", "scoring_system": "epss", "scoring_elements": "0.11522", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00038", "scoring_system": "epss", "scoring_elements": "0.11369", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00038", "scoring_system": "epss", "scoring_elements": "0.11453", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00038", "scoring_system": "epss", "scoring_elements": "0.11511", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00043", "scoring_system": "epss", "scoring_elements": "0.13255", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00043", "scoring_system": "epss", "scoring_elements": "0.13379", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00043", "scoring_system": "epss", "scoring_elements": "0.13443", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00043", "scoring_system": "epss", "scoring_elements": "0.13305", "published_at": "2026-04-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-31813" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31813", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31813" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012513", "reference_id": "1012513", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012513" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2095020", "reference_id": "2095020", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2095020" }, { "reference_url": "https://security.archlinux.org/AVG-2763", "reference_id": "AVG-2763", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2763" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2022-31813.json", "reference_id": "CVE-2022-31813", "reference_type": "", "scores": [ { "value": "low", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2022-31813.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6753", "reference_id": "RHSA-2022:6753", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6753" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7647", "reference_id": "RHSA-2022:7647", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7647" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8067", "reference_id": "RHSA-2022:8067", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8067" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8840", "reference_id": "RHSA-2022:8840", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8840" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8841", "reference_id": "RHSA-2022:8841", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8841" }, { "reference_url": "https://usn.ubuntu.com/5487-1/", "reference_id": "USN-5487-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5487-1/" }, { "reference_url": "https://usn.ubuntu.com/5487-3/", "reference_id": "USN-5487-3", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5487-3/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2022-31813" ], "risk_score": 3.3, "exploitability": "0.5", "weighted_severity": "6.6", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-p2a1-afnh-7qca" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3826?format=api", "vulnerability_id": "VCID-pnc8-bb23-vqh1", "summary": "A carefully crafted request body can cause a read to a random memory area which could cause the process to crash.\n\nThis issue affects Apache HTTP Server 2.4.52 and earlier.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22719.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22719.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-22719", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.29312", "scoring_system": "epss", "scoring_elements": "0.96593", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.29312", "scoring_system": "epss", "scoring_elements": "0.96591", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.29312", "scoring_system": "epss", "scoring_elements": "0.96578", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.29312", "scoring_system": "epss", "scoring_elements": "0.96581", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.29312", "scoring_system": "epss", "scoring_elements": "0.96589", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.29312", "scoring_system": "epss", "scoring_elements": "0.96573", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.29423", "scoring_system": "epss", "scoring_elements": "0.96602", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.29423", "scoring_system": "epss", "scoring_elements": "0.96599", "published_at": "2026-04-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-22719" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22719", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22719" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064322", "reference_id": "2064322", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064322" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2022-22719.json", "reference_id": "CVE-2022-22719", "reference_type": "", "scores": [ { "value": "moderate", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2022-22719.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6753", "reference_id": "RHSA-2022:6753", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6753" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7647", "reference_id": "RHSA-2022:7647", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7647" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8067", "reference_id": "RHSA-2022:8067", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8067" }, { "reference_url": "https://usn.ubuntu.com/5333-1/", "reference_id": "USN-5333-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5333-1/" }, { "reference_url": "https://usn.ubuntu.com/5333-2/", "reference_id": "USN-5333-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5333-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2022-22719" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pnc8-bb23-vqh1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3830?format=api", "vulnerability_id": "VCID-qm7e-n9ay-hufy", "summary": "Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-26377.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-26377.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-26377", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.39296", "scoring_system": "epss", "scoring_elements": "0.97289", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.39296", "scoring_system": "epss", "scoring_elements": "0.97287", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.39296", "scoring_system": "epss", "scoring_elements": "0.97288", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.3988", "scoring_system": "epss", "scoring_elements": "0.97321", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.3988", "scoring_system": "epss", "scoring_elements": "0.97314", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.3988", "scoring_system": "epss", "scoring_elements": "0.97308", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.3988", "scoring_system": "epss", "scoring_elements": "0.97313", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.3988", "scoring_system": "epss", "scoring_elements": "0.9732", "published_at": "2026-04-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-26377" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26377", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26377" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012513", "reference_id": "1012513", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012513" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2094997", "reference_id": "2094997", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2094997" }, { "reference_url": "https://security.archlinux.org/AVG-2763", "reference_id": "AVG-2763", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2763" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2022-26377.json", "reference_id": "CVE-2022-26377", "reference_type": "", "scores": [ { "value": "moderate", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2022-26377.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6753", "reference_id": "RHSA-2022:6753", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6753" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7647", "reference_id": "RHSA-2022:7647", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7647" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8067", "reference_id": "RHSA-2022:8067", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8067" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8840", "reference_id": "RHSA-2022:8840", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8840" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8841", "reference_id": "RHSA-2022:8841", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8841" }, { "reference_url": "https://usn.ubuntu.com/5487-1/", "reference_id": "USN-5487-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5487-1/" }, { "reference_url": "https://usn.ubuntu.com/5487-3/", "reference_id": "USN-5487-3", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5487-3/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2022-26377" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qm7e-n9ay-hufy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3823?format=api", "vulnerability_id": "VCID-qn74-neyt-jkg9", "summary": "It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. \n\nIf files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution.\n\nThis issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-42013.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-42013.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-42013", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.9441", "scoring_system": "epss", "scoring_elements": "0.99979", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.9441", "scoring_system": "epss", "scoring_elements": "0.99978", "published_at": "2026-04-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-42013" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/08/1", "reference_id": "1", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/08/1" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/09/1", "reference_id": "1", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/09/1" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/16/1", "reference_id": "1", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/16/1" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/08/2", "reference_id": "2", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/08/2" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011900", "reference_id": "2011900", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011900" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/08/3", "reference_id": "3", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/08/3" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/15/3", "reference_id": "3", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/15/3" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/08/4", "reference_id": "4", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/08/4" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/11/4", "reference_id": "4", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/11/4" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/08/5", "reference_id": "5", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/08/5" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/07/6", "reference_id": "6", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/07/6" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/10/08/6", "reference_id": "6", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2021/10/08/6" }, { "reference_url": "http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html", "reference_id": "Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html" }, { "reference_url": "https://www.povilaika.com/apache-2-4-50-exploit/", "reference_id": "apache-2-4-50-exploit", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "https://www.povilaika.com/apache-2-4-50-exploit/" }, { "reference_url": "http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.html", "reference_id": "Apache-2.4.50-Remote-Code-Execution.html", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.html" }, { "reference_url": "http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html", "reference_id": "Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html" }, { "reference_url": "http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html", "reference_id": "Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html" }, { "reference_url": "http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html", "reference_id": "Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html" }, { "reference_url": "http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html", "reference_id": "Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html" }, { "reference_url": "https://security.archlinux.org/ASA-202110-1", "reference_id": "ASA-202110-1", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-202110-1" }, { "reference_url": "https://security.archlinux.org/AVG-2450", "reference_id": "AVG-2450", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2450" }, { "reference_url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "reference_id": "cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ" }, { "reference_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/50406.sh", "reference_id": "CVE-2021-42013", "reference_type": "exploit", "scores": [], "url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/50406.sh" }, { "reference_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/50446.sh", "reference_id": "CVE-2021-42013", "reference_type": "exploit", "scores": [], "url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/50446.sh" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2021-42013.json", "reference_id": "CVE-2021-42013", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2021-42013.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "http://jvn.jp/en/jp/JVN51106450/index.html", "reference_id": "index.html", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "http://jvn.jp/en/jp/JVN51106450/index.html" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20211029-0009/", "reference_id": "ntap-20211029-0009", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20211029-0009/" }, { "reference_url": "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E", "reference_id": "r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E", "reference_id": "r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E", "reference_id": "rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "reference_id": "RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/", "reference_id": "WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Act", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2021-42013" ], "risk_score": 10.0, "exploitability": "2.0", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qn74-neyt-jkg9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3818?format=api", "vulnerability_id": "VCID-rdtq-8ng5-53fn", "summary": "A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS).\n\nThis issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-36160.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-36160.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-36160", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.03716", "scoring_system": "epss", "scoring_elements": "0.8792", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.03716", "scoring_system": "epss", "scoring_elements": "0.87977", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.03716", "scoring_system": "epss", "scoring_elements": "0.87974", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.03716", "scoring_system": "epss", "scoring_elements": "0.87985", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.03716", "scoring_system": "epss", "scoring_elements": "0.87978", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.03716", "scoring_system": "epss", "scoring_elements": "0.8793", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.03716", "scoring_system": "epss", "scoring_elements": "0.87943", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.03716", "scoring_system": "epss", "scoring_elements": "0.87947", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.03716", "scoring_system": "epss", "scoring_elements": "0.87968", "published_at": "2026-04-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-36160" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2005124", "reference_id": "2005124", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2005124" }, { "reference_url": "https://security.archlinux.org/AVG-2289", "reference_id": "AVG-2289", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2289" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2021-36160.json", "reference_id": "CVE-2021-36160", "reference_type": "", "scores": [ { "value": "moderate", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2021-36160.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1915", "reference_id": "RHSA-2022:1915", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1915" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6753", "reference_id": "RHSA-2022:6753", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6753" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7143", "reference_id": "RHSA-2022:7143", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7143" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7144", "reference_id": "RHSA-2022:7144", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7144" }, { "reference_url": "https://usn.ubuntu.com/5090-1/", "reference_id": "USN-5090-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5090-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2021-36160" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rdtq-8ng5-53fn" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3819?format=api", "vulnerability_id": "VCID-wrw6-uzz4-rkfb", "summary": "ap_escape_quotes() may write beyond the end of a buffer when given malicious input. \nNo included modules pass untrusted data to these functions, but third-party / external modules may.\n\nThis issue affects Apache HTTP Server 2.4.48 and earlier.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-39275.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-39275.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-39275", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.37674", "scoring_system": "epss", "scoring_elements": "0.97171", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.37674", "scoring_system": "epss", "scoring_elements": "0.97199", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.37674", "scoring_system": "epss", "scoring_elements": "0.97193", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.37674", "scoring_system": "epss", "scoring_elements": "0.97194", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.37674", "scoring_system": "epss", "scoring_elements": "0.97198", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.37674", "scoring_system": "epss", "scoring_elements": "0.97177", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.37674", "scoring_system": "epss", "scoring_elements": "0.97183", "published_at": "2026-04-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-39275" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2005119", "reference_id": "2005119", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2005119" }, { "reference_url": "https://security.archlinux.org/AVG-2289", "reference_id": "AVG-2289", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2289" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2021-39275.json", "reference_id": "CVE-2021-39275", "reference_type": "", "scores": [ { "value": "low", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2021-39275.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0143", "reference_id": "RHSA-2022:0143", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0143" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0891", "reference_id": "RHSA-2022:0891", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0891" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6753", "reference_id": "RHSA-2022:6753", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6753" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7143", "reference_id": "RHSA-2022:7143", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7143" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7144", "reference_id": "RHSA-2022:7144", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7144" }, { "reference_url": "https://usn.ubuntu.com/5090-1/", "reference_id": "USN-5090-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5090-1/" }, { "reference_url": "https://usn.ubuntu.com/5090-2/", "reference_id": "USN-5090-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5090-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2021-39275" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-wrw6-uzz4-rkfb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3828?format=api", "vulnerability_id": "VCID-xfm9-e5nr-wyat", "summary": "If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes.\n\nThis issue affects Apache HTTP Server 2.4.52 and earlier.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22721.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22721.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-22721", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.13159", "scoring_system": "epss", "scoring_elements": "0.94126", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.13159", "scoring_system": "epss", "scoring_elements": "0.94121", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.13159", "scoring_system": "epss", "scoring_elements": "0.94104", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.13159", "scoring_system": "epss", "scoring_elements": "0.94108", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.13159", "scoring_system": "epss", "scoring_elements": "0.94117", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.13159", "scoring_system": "epss", "scoring_elements": "0.94093", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.13224", "scoring_system": "epss", "scoring_elements": "0.94143", "published_at": "2026-04-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-22721" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22721", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22721" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064320", "reference_id": "2064320", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064320" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2022-22721.json", "reference_id": "CVE-2022-22721", "reference_type": "", "scores": [ { "value": "low", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2022-22721.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6753", "reference_id": "RHSA-2022:6753", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6753" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7647", "reference_id": "RHSA-2022:7647", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7647" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8067", "reference_id": "RHSA-2022:8067", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8067" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8840", "reference_id": "RHSA-2022:8840", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8840" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8841", "reference_id": "RHSA-2022:8841", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8841" }, { "reference_url": "https://usn.ubuntu.com/5333-1/", "reference_id": "USN-5333-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5333-1/" }, { "reference_url": "https://usn.ubuntu.com/5333-2/", "reference_id": "USN-5333-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5333-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2022-22721" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xfm9-e5nr-wyat" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3825?format=api", "vulnerability_id": "VCID-xwnu-h1xh-3bg6", "summary": "A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts).\nThe Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one.\n\nThis issue affects Apache HTTP Server 2.4.51 and earlier.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-44790.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-44790.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-44790", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.86011", "scoring_system": "epss", "scoring_elements": "0.99393", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.87092", "scoring_system": "epss", "scoring_elements": "0.99437", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.87092", "scoring_system": "epss", "scoring_elements": "0.99438", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.87092", "scoring_system": "epss", "scoring_elements": "0.99439", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.87092", "scoring_system": "epss", "scoring_elements": "0.99441", "published_at": "2026-04-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-44790" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034674", "reference_id": "2034674", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034674" }, { "reference_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/51193.py", "reference_id": "CVE-2021-44790", "reference_type": "exploit", "scores": [], "url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/51193.py" }, { "reference_url": "https://httpd.apache.org/security/json/CVE-2021-44790.json", "reference_id": "CVE-2021-44790", "reference_type": "", "scores": [ { "value": "important", "scoring_system": "apache_httpd", "scoring_elements": "" } ], "url": "https://httpd.apache.org/security/json/CVE-2021-44790.json" }, { "reference_url": "https://security.gentoo.org/glsa/202208-20", "reference_id": "GLSA-202208-20", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-20" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0143", "reference_id": "RHSA-2022:0143", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0143" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0258", "reference_id": "RHSA-2022:0258", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0258" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0288", "reference_id": "RHSA-2022:0288", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0288" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0303", "reference_id": "RHSA-2022:0303", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0303" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1136", "reference_id": "RHSA-2022:1136", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1136" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1137", "reference_id": "RHSA-2022:1137", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1137" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1138", "reference_id": "RHSA-2022:1138", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1138" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1139", "reference_id": "RHSA-2022:1139", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1139" }, { "reference_url": "https://usn.ubuntu.com/5212-1/", "reference_id": "USN-5212-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5212-1/" }, { "reference_url": "https://usn.ubuntu.com/5212-2/", "reference_id": "USN-5212-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5212-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/77452?format=api", "purl": "pkg:ebuild/www-servers/apache@2.4.54", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" } ], "aliases": [ "CVE-2021-44790" ], "risk_score": 10.0, "exploitability": "2.0", "weighted_severity": "8.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xwnu-h1xh-3bg6" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-servers/apache@2.4.54" }