Apache 2

Tenable plugin 158900 fires on Apache HTTP Server versions earlier than 2.4.53 and bundles four flaws fixed on 2022-03-14: CVE-2022-22720 request smuggling in core request handling; CVE-2022-23943 out-of-bounds write in mod_sed; CVE-2022-22719 memory-read/DoS in mod_lua r:parsebody(); and CVE-2022-22721, an integer-overflow-to-OOB-write case that only matters on 32-bit builds when LimitXMLRequestBody is raised above ~350 MB or left effectively unlimited. Affected upstream versions are 2.4.52 and earlier for all four issues, but three of them require optional modules or non-default config.

Tenable's worst-case 9.8 scoring is technically defensible for the most dangerous individual CVEs, but it overstates fleet risk for a patching team. In real enterprise deployments, mod_sed is uncommon, mod_lua is rarer still, and the 32-bit giant-XML prerequisite is edge-case territory; the only broadly relevant issue is CVE-2022-22720, which is serious because it is unauthenticated and remote, but still needs the classic request-smuggling conditions to translate into meaningful impact. Add in the fact that this plugin is version-only and will over-flag distro backports, and this lands as HIGH, not CRITICAL.

Why this verdict

• Downward adjustment for prerequisite sprawl: CVE-2022-23943 needs mod_sed, CVE-2022-22719 needs mod_lua plus r:parsebody() usage, and CVE-2022-22721 needs 32-bit plus oversized XML body settings. Those are compounding reachability filters, not broad default conditions.
• Kept HIGH because one path is truly remote: CVE-2022-22720 is unauthenticated, network-reachable, and applies to ordinary Apache request handling. On public reverse proxies or edge nodes, request smuggling is a real attacker primitive.
• Downward adjustment for post-condition dependence: request smuggling usually needs a cooperative chain to turn parser desync into cache poisoning, auth confusion, or backend reachability. That is materially less reliable than a straight unauthenticated RCE against a single host.
• Downward adjustment for detection quality: Tenable states it did not test the issue and relied on self-reported version only. That means older-looking but backported Ubuntu/Debian/RHEL packages will inflate the apparent blast radius.
• Not downgraded to MEDIUM because exposure is huge: Apache remains everywhere, and Bitsight still sees millions of observations tied to the vulnerable line/CVEs. Even a non-KEV smuggling flaw on a ubiquitous edge service deserves active patching attention.

Why not higher?

This is not a clean fleet-wide CRITICAL because the scary scores are being carried by branches that many hosts cannot reach at all. There is also no KEV listing or strong public evidence of widespread active exploitation for this specific 2.4.53 bundle as of 2026-06-01, and the most realistic bug is request smuggling rather than default-path RCE.

Why not lower?

It is still an internet-service finding on one of the most exposed server products in enterprise, and CVE-2022-22720 is unauthenticated remote. If you run Apache as a reverse proxy, cache, or front door, parser desync bugs can produce outsized downstream impact even when the base server itself is not trivially owned.

1. Validate backports before you panic-patch — Check package changelogs and vendor advisories first, especially on Ubuntu, Debian, and RHEL-derived systems. Do this within the HIGH noisgate mitigation SLA of 30 days so you stop burning cycles on version-string false positives and focus on truly unpatched hosts.
2. Disable mod_sed and mod_lua if unused — Removing optional modules collapses three-fourths of this advisory's scary surface area, especially CVE-2022-23943 and CVE-2022-22719. Inventory and remove them within 30 days on internet-facing hosts first.
3. Keep ProxyRequests Off unless you explicitly need forward proxying — Forward-proxy behavior and complex proxy chains make request-smuggling outcomes far worse. Confirm the setting and tighten proxy use cases within 30 days on any Apache edge node.
4. Normalize HTTP at the edge — Enforce strict request parsing and malformed-request rejection on the CDN, load balancer, reverse proxy, or WAF sitting in front of Apache. That reduces the practical reach of CVE-2022-22720; deploy or validate these controls within 30 days.
5. Review body-size limits on legacy 32-bit systems — If you still have 32-bit Apache anywhere, verify LimitXMLRequestBody is not set above roughly 350MB and is not effectively unlimited. This is niche but fast to audit, and it should be done within 30 days.

Run this on the target Apache host as root or with sudo, because it inspects local package metadata and Apache config helpers. Save it as verify_apache_2453.sh and run sudo bash verify_apache_2453.sh; it prints exactly one of VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# verify_apache_2453.sh
# Checks whether local Apache HTTP Server is patched for the 2.4.53 bundle
# (CVE-2022-22719, CVE-2022-22720, CVE-2022-22721, CVE-2022-23943).
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

need_cves=("CVE-2022-22719" "CVE-2022-22720" "CVE-2022-22721" "CVE-2022-23943")

print_result() {
  local status="$1"
  case "$status" in
    PATCHED) echo "PATCHED"; exit 0 ;;
    VULNERABLE) echo "VULNERABLE"; exit 1 ;;
    *) echo "UNKNOWN"; exit 2 ;;
  esac
}

have_cmd() { command -v "$1" >/dev/null 2>&1; }

version_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

extract_ver() {
  echo "$1" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1
}

APACHE_CTL=""
for c in apache2ctl apachectl httpd apache2; do
  if have_cmd "$c"; then
    APACHE_CTL="$c"
    break
  fi
done

[ -n "$APACHE_CTL" ] || print_result UNKNOWN

raw_ver="$($APACHE_CTL -v 2>/dev/null || true)"
ver="$(extract_ver "$raw_ver")"

# Fast path: upstream/newer version.
if [ -n "$ver" ] && version_ge "$ver" "2.4.53"; then
  print_result PATCHED
fi

# Backport checks for Debian/Ubuntu.
if have_cmd dpkg-query; then
  if dpkg-query -W -f='${Status}' apache2 2>/dev/null | grep -q 'install ok installed'; then
    chlog="/usr/share/doc/apache2/changelog.Debian.gz"
    if [ -r "$chlog" ]; then
      hits=0
      for cve in "${need_cves[@]}"; do
        if zgrep -qi "$cve" "$chlog"; then
          hits=$((hits+1))
        fi
      done
      if [ "$hits" -eq 4 ]; then
        print_result PATCHED
      fi
    fi
  fi
fi

# Backport checks for RPM families.
if have_cmd rpm; then
  for pkg in httpd apache2; do
    if rpm -q "$pkg" >/dev/null 2>&1; then
      hits=0
      for cve in "${need_cves[@]}"; do
        if rpm -q --changelog "$pkg" 2>/dev/null | grep -qi "$cve"; then
          hits=$((hits+1))
        fi
      done
      if [ "$hits" -eq 4 ]; then
        print_result PATCHED
      fi
    fi
  done
fi

# If we can confidently see an old upstream version and no backport proof, call it vulnerable.
if [ -n "$ver" ] && ! version_ge "$ver" "2.4.53"; then
  print_result VULNERABLE
fi

print_result UNKNOWN

Sources

1. Tenable Nessus Plugin 158900
2. Apache HTTP Server 2.4 vulnerabilities
3. NVD CVE-2022-22720
4. NVD CVE-2022-22721
5. NVD CVE-2022-23943
6. Ubuntu CVE-2022-23943
7. Debian security tracker CVE-2022-23943
8. CISA Known Exploited Vulnerabilities Catalog