title: Information Disclosure in mod_lua with websockets
description: Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.
problem types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
product: Apache HTTP Server
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 2.4.53, status: affected, version: unspecified, versionType: custom
}
metrics:
other: [
content: {'other': 'low'}
type: unknown
]