CVE-2022-28331
Published: 31 January 2023
Summary
CVE-2022-28331 is a critical-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Apache Portable Runtime. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 46.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
On Windows, Apache Portable Runtime 1.7.0 and earlier contain an integer overflow in apr_socket_sendv() that can cause a write beyond the end of a stack-based buffer. The flaw is tracked as CVE-2022-28331 with a CVSS 3.1 score of 9.8 and is classified under CWE-190.
Remote attackers without authentication or user interaction can send crafted network traffic to trigger the overflow, resulting in full compromise of confidentiality, integrity, and availability on affected systems.
The Apache mailing-list thread at the referenced URL describes the issue and links to corrective updates for the library.
EPSS for the CVE rose from a low baseline to a peak of 0.1057 on 2025-01-22 before receding to the current value of 0.0030, indicating that exploitation interest increased after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-32783
Vulnerability details
On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.