Unauthenticated process crash via multipart buffer overflow

Buffer overflow in Apache libapreq2 2.16 and earlier allows remote attackers to crash processes via multipart form uploads. The multipart form parser copies attacker-controlled input without checking that it fits the destination buffer; Apache has not identified the function. No authentication or user interaction is required, and the documented consequence is service interruption from a process crash, not code execution.