CVE-2022-22728

What it actually does

A remote attacker can trigger a buffer overflow during multipart form data parsing in libapreq2 2.16 and earlier, causing the process to crash.

Why it matters to the business

Applications using the library may suffer repeated crashes from crafted upload requests, leading to service outages and the need for manual restarts or failover.

How an attack unfolds

An attacker sends a specially crafted multipart form upload that exceeds internal buffer limits during header or part processing, forcing an overflow that terminates the worker process.

How to fix it

Upgrade Apache libapreq2 to a version newer than 2.16. Apply the latest packages from Fedora, Debian, or other distributions once released. Where immediate upgrade is not possible, restrict multipart upload sizes at the web server or WAF layer.

How to confirm the fix worked

Confirm the running libapreq2 version is newer than 2.16. In a test environment, replay a minimal crashing upload request and verify the process remains stable.

Typical attack path

1. Locate a web endpoint accepting multipart/form-data POST requests that uses the vulnerable library
2. Craft a request containing an oversized or malformed part header designed to overflow the buffer
3. Transmit the request to the target
4. Observe process termination and resulting denial of service

How to detect it

Review web server and application logs for abrupt worker process terminations that coincide with multipart form POST requests. Correlate spikes in upload traffic with availability alerts.

What your security team should do

• Inventory all deployments of libapreq2 and schedule upgrades to patched releases
• Add rate limiting and size checks on multipart uploads at the perimeter
• Enable core-dump or crash logging to capture future incidents for forensics