CVE-2022-29404 in HTTP Server
Summary
by MITRE • 06/09/2022
In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2025
The vulnerability identified as CVE-2022-29404 affects the Apache HTTP Server version 2.4.53 and earlier, presenting a significant denial of service risk through improper input handling in lua script processing. This flaw specifically manifests when a lua script invokes the r:parsebody(0) function, which lacks default constraints on input size, creating a potential attack vector that can be exploited by malicious actors to consume excessive system resources. The issue stems from the absence of safeguards that would normally prevent unbounded input processing, allowing attackers to craft requests that could overwhelm server capacity and render services unavailable to legitimate users.
The technical implementation of this vulnerability resides in the lua module's request parsing mechanism within the Apache HTTP Server framework. When r:parsebody(0) is executed, it processes request bodies without imposing reasonable limits on data size, effectively creating a resource exhaustion scenario. This behavior aligns with CWE-400, which categorizes unchecked resource consumption as a critical weakness in software design. The function call bypasses normal input validation mechanisms that would typically enforce size limits, enabling an attacker to submit arbitrarily large payloads that the server attempts to process entirely in memory. The absence of input sanitization creates a direct pathway for denial of service conditions where computational resources become consumed proportionally to the input size, ultimately leading to service disruption.
The operational impact of this vulnerability extends beyond simple service interruption, as it represents a critical weakness that can be exploited by remote attackers without requiring authentication or elevated privileges. Attackers can leverage this flaw by crafting malicious HTTP requests that contain oversized payloads, causing the server to allocate excessive memory and processing power for parsing operations. The vulnerability affects any system running Apache HTTP Server versions up to 2.4.53 that has lua module enabled and processes requests through lua scripts that utilize the r:parsebody(0) function. This creates a widespread risk across various deployment scenarios including web applications, API gateways, and content management systems that rely on lua scripting for dynamic content processing.
Mitigation strategies for CVE-2022-29404 must address both immediate defensive measures and long-term architectural improvements to prevent similar vulnerabilities. The primary recommendation involves upgrading to Apache HTTP Server version 2.4.54 or later, where the vulnerability has been resolved through the implementation of default input size limits for the r:parsebody() function. System administrators should also implement request size limiting mechanisms at the server level using directives such as LimitRequestBody to prevent excessive input processing. Additionally, organizations should conduct thorough code reviews of lua scripts to identify and modify any instances that might invoke r:parsebody(0) without proper input validation. The ATT&CK framework categorizes this vulnerability under T1499.004 for network denial of service, emphasizing the importance of implementing robust input validation as a defensive control measure. Organizations should also consider implementing rate limiting and monitoring solutions to detect anomalous request patterns that might indicate exploitation attempts. The vulnerability demonstrates the critical importance of input validation in preventing resource exhaustion attacks and aligns with security best practices outlined in OWASP Top 10, particularly the prevention of resource exhaustion through proper input handling and size limiting mechanisms.