Paper/Archive/CVE-2022-22720

CVE-2022-22720

Apache Software Foundation Apache HTTP Server — HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier

EPSS 28%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 98.1.981 × 2019.6 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

Affected

ProductAffectedFixed inSource

Apache HTTP ServerApache HTTP Server 2.4 – 2.4.52–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refhttpd.apache.org/security/vulnerabilities_24.html refopenwall.com/lists/oss-security/2022/03/14/3 advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO reflists.debian.org/debian-lts-announce/2022/03/msg00033.html advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO reforacle.com/security-alerts/cpuapr2022.html refsecurity.netapp.com/advisory/ntap-20220321-0001 refseclists.org/fulldisclosure/2022/May/33 refseclists.org/fulldisclosure/2022/May/35 refseclists.org/fulldisclosure/2022/May/38 reforacle.com/security-alerts/cpujul2022.html refsupport.apple.com/kb/HT213257 refsupport.apple.com/kb/HT213256 refsupport.apple.com/kb/HT213255 advisorysecurity.gentoo.org/glsa/202208-20