CVE-2022-30556— Information Disclosure in mod_lua with websockets
Quick assessment
Affected
Apache Software Foundation Apache HTTP Server
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache HTTP Server是美国阿帕奇（Apache）基金会的一款开源网页服务器。该服务器具有快速、可靠且可通过简单的API进行扩充的特点。 Apache HTTP Server 2.4.53 及之前版本存在安全漏洞源于会向调用 r:wsread() 的应用程序返回指向超过为缓冲区分配的存储结束的长度
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-30556
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Information Disclosure in mod_lua with websockets
Source: CVE Program / CVE List V5
Vulnerability Description
Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Apache HTTP Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache HTTP Server是美国阿帕奇（Apache）基金会的一款开源网页服务器。该服务器具有快速、可靠且可通过简单的API进行扩充的特点。 Apache HTTP Server 2.4.53 及之前版本存在安全漏洞源于会向调用 r:wsread() 的应用程序返回指向超过为缓冲区分配的存储结束的长度
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server | unspecified ~ 2.4.53 | - |
|
II. Public POCs for CVE-2022-30556
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-30556
请登录查看更多情报信息。
Vendor Advisories for CVE-2022-30556 (3)
-
https://security.netapp.com/advisory/ntap-20220624-0005/ x_refsource_CONFIRM
-
🔗 Apache HTTPD: Multiple Vulnerabilities (GLSA 202208-20) — Gentoo security Read full article vendor-advisory x_refsource_GENTOO
Mailing List Discussions for CVE-2022-30556 (3)
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/ vendor-advisory x_refsource_FEDORA
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/ vendor-advisory x_refsource_FEDORA
-
Same Patch Batch · Apache Software Foundation · 2022-06-08 · 8 CVEs total
| CVE-2022-31813 | mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism | |
| CVE-2022-30522 | mod_sed denial of service | |
| CVE-2022-29404 | Denial of service in mod_lua r:parsebody | |
| CVE-2022-28615 | Read beyond bounds in ap_strcmp_match() | |
| CVE-2022-28614 | read beyond bounds via ap_rwrite() | |
| CVE-2022-28330 | read beyond bounds in mod_isapi | |
| CVE-2022-26377 | mod_proxy_ajp: Possible request smuggling |
IV. Related Vulnerabilities
Same product: Apache HTTP Server
-
CVE-2026-63686
Apache HTTP Server: mod_xml2enc crash on charset conversion -
CVE-2026-93546
Apache HTTP Server: mod_dav_fs namespace overflow -
CVE-2026-79768
Apache HTTP Server: mod_userdir information disclosure -
CVE-2026-73637
Apache HTTP Server: mod_auth_digest DoS attack -
CVE-2026-73636
Apache HTTP Server: mod_auth_digest one-time-nonce replay at
Same vendor: Apache Software Foundation
-
CVE-2026-85499
Apache SkyWalking BanyanDB: Canopy does not enforce readonly -
CVE-2026-103636
Apache DataSketches: datasketches-cpp: Out-of-bounds read in -
CVE-2026-103635
Apache DataSketches: datasketches-cpp: Out-of-bounds read in -
CVE-2026-103513
Apache DataSketches: datasketches-cpp: Out-of-bounds read an -
CVE-2026-103501
Apache DataSketches: datasketches-cpp: HLL CouponList Deseri
Same weakness: CWE-200
-
CVE-2026-108811
WMCMS index.php information disclosure -
CVE-2026-108810
tsi-coop tsi-dpdp-cms JSON Schema Validation information dis -
CVE-2026-108861
Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via exec -
CVE-2026-108578
Neterbit NW-431F Embedded Web Server sms.json information di -
CVE-2026-18496
Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Infor
V. Comments for CVE-2022-30556
No comments yet