home / blog
2026-11-04 · critical
CVE-2022-23943: Out-of-bounds Write in Apache mod_sed
Memory overwrite in Apache mod_sed, CVSS 9.8 critical. Affects 2.4.52 and prior versions.
CVE-2022-23943 is an out-of-bounds write vulnerability in the mod_sed module of Apache HTTP Server versions up to 2.4.52. An attacker can write data beyond allocated heap memory boundaries, potentially with attacker-controlled content. It impacts all unpatched Apache 2.4.x servers where mod_sed is compiled and loaded.
CVSS 9.8 rates this as critical severity. NVD published the vulnerability on March 14, 2022. A significant signal emerged: on November 4, 2026, public GitHub repositories containing exploit code for CVE-2022-23943 were detected. This indicates that working exploit code is accessible to determined attackers.
Administrators must urgently verify if their Apache servers run version 2.4.52 or earlier. First action: upgrade to a later version as soon as official releases are available, consulting Apache security bulletins. If immediate upgrade is not feasible, assess whether mod_sed is necessary; if not critical, disabling the module reduces attack surface. Monitor mod_sed and application logs for anomalies suggesting exploitation attempts.
At a glance
- What
- Out-of-bounds write in mod_sed module of Apache HTTP Server 2.4. Attackers can overwrite heap memory with potentially attacker-controlled data.
- Severity
- CVSS 9.8 critical. Declared critical by official sources.
- Affected versions
- Apache HTTP Server 2.4.52 and all prior versions. All 2.4.x releases up to and including 2.4.52.
- Fix
- Upgrade to version after 2.4.52. Check Apache security bulletins for next stable release version.
- Status
- Published March 14, 2022. GitHub repositories with exploit code detected November 4, 2026. Patch status: not confirmed if released.
- Action
- Inventory Apache 2.4.52 and prior installations. Apply available patch. If unavailable, disable mod_sed if not critical. Monitor mod_sed logs.
Sources: NVD, CVE-2022-23943