CVE-2022-23943: Apache HTTP Server Buffer Overflow Flaw

CVE-2022-23943 Overview

CVE-2022-23943 is an out-of-bounds write vulnerability in the mod_sed module of Apache HTTP Server. The flaw allows a remote attacker to overwrite heap memory with attacker-controlled data, potentially leading to remote code execution or denial of service. The issue affects Apache HTTP Server 2.4.52 and prior versions when mod_sed is enabled to filter request or response bodies. Downstream distributions including Fedora, Debian, Gentoo, NetApp, and Oracle products that ship Apache HTTP Server are also affected.

Critical Impact
A remote, unauthenticated attacker can corrupt heap memory in the Apache worker process, enabling arbitrary code execution in the context of the web server.

Affected Products

Apache HTTP Server 2.4.52 and earlier 2.4.x versions
Fedora 34, 35, and 36; Debian Linux 9
Oracle HTTP Server 12.2.1.3.0 and 12.2.1.4.0; Oracle ZFS Storage Appliance Kit 8.8

Discovery Timeline

2022-03-14 - CVE-2022-23943 published to the National Vulnerability Database (NVD)
2022-03-14 - Issue disclosed on the Openwall oss-security mailing list
2022-03-21 - NetApp security advisory published
2022-04 - Oracle addresses the issue in the April 2022 Critical Patch Update
2022-08 - Gentoo GLSA 202208-20 released
2025-05-01 - Last updated in NVD database

Technical Details for CVE-2022-23943

Vulnerability Analysis

The vulnerability resides in mod_sed, an Apache HTTP Server filter module that applies sed-style stream-editing expressions to request or response bodies. When mod_sed processes data, it allocates heap buffers to hold the transformed output. A size calculation error during buffer growth leads to a heap-based out-of-bounds write [CWE-787], with a contributing integer overflow [CWE-190] in the length computation.

Because mod_sed operates on data the attacker can influence through HTTP requests, the corrupted bytes can be partly attacker-controlled. This satisfies the preconditions for adjacent heap metadata corruption and, with the right heap layout, arbitrary code execution in the httpd worker process. The flaw is reachable over the network without authentication or user interaction.

Root Cause

The root cause is incorrect handling of buffer-length arithmetic inside mod_sed when expanding output during pattern substitution. An integer overflow leads to undersized allocations, after which subsequent writes spill past the end of the allocated heap chunk and clobber adjacent heap structures.

Attack Vector

Exploitation requires that the target server has mod_sed enabled and configured to filter content through directives such as AddOutputFilterByType Sed or InputSed/OutputSed within a Location or Directory block. An attacker submits a crafted HTTP request whose body, or the response body being transformed, triggers the faulty size calculation. The resulting heap corruption can crash the worker, leak memory, or be shaped into a code-execution primitive.

No public proof-of-concept exploit is listed in the enriched data, but the EPSS percentile of 98.3 indicates exploit research interest is high relative to the broader CVE population. Refer to the Apache HTTPD Security Vulnerabilities advisory for vendor technical details.

Detection Methods for CVE-2022-23943

Indicators of Compromise

Unexpected httpd or apache2 worker crashes, segmentation faults, or core dumps coinciding with requests routed through mod_sed filters.
HTTP requests with unusually large or malformed bodies targeting endpoints configured with Sed input or output filters.
New child processes spawned from httpd that execute shells or network utilities such as bash, sh, curl, or nc.

Detection Strategies

Inventory Apache HTTP Server installations and identify those running 2.4.52 or earlier with mod_sed loaded via LoadModule sed_module.
Inspect configuration files for AddOutputFilterByType Sed, InputSed, and OutputSed directives that expose the vulnerable code path.
Correlate web access logs with worker-process crash events in error_log to identify exploitation attempts that destabilize the server.

Monitoring Recommendations

Forward Apache error_log and access_log to a centralized log platform and alert on repeated child pid ... exit signal Segmentation fault entries.
Monitor for child processes of httpd invoking interactive shells or outbound network connections, which would indicate post-exploitation behavior.
Track vulnerability scanner output for hosts still reporting Apache HTTP Server 2.4.52 or earlier after the patch window.

How to Mitigate CVE-2022-23943

Immediate Actions Required

Upgrade Apache HTTP Server to version 2.4.53 or later, which contains the official fix for the mod_sed out-of-bounds write.
Apply distribution updates from Debian, Fedora, Gentoo, NetApp, and Oracle as documented in their respective advisories.
Restart the httpd service after patching so that worker processes load the corrected module binary.

Patch Information

The Apache HTTP Server project addressed this issue in version 2.4.53. See the Apache HTTPD 2.4 Security Advisory for the authoritative fix reference. Oracle issued patches for HTTP Server 12.2.1.3.0, 12.2.1.4.0, and ZFS Storage Appliance Kit 8.8 in the Oracle April 2022 Critical Patch Update. Distribution-specific updates are available from the Debian LTS announcement and Fedora package announcements.

Workarounds

If patching cannot be performed immediately, disable mod_sed by commenting out the LoadModule sed_module modules/mod_sed.so line in the Apache configuration.
Remove AddOutputFilterByType Sed, InputSed, and OutputSed directives from all virtual host and Directory blocks.
Place a hardened reverse proxy or web application firewall in front of Apache to reject requests with abnormally large bodies destined for filtered endpoints.

bash

# Verify installed Apache version
httpd -v
# or on Debian/Ubuntu
apache2 -v

# Confirm mod_sed status
httpd -M 2>/dev/null | grep sed

# Disable mod_sed on Debian/Ubuntu and reload
a2dismod sed
systemctl reload apache2