CVE-2022-22720
HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier
- State
- Published
- Severity
- Not scored
- Published
- Mar 14, 2022
- Updated
- Aug 3, 2024
- Reserved
- Jan 6, 2022
Description
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
Scores
The record has no CVSS score.
Weaknesses
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Affected Products
| Product | Versions |
|---|---|
Apache HTTP ServerApache Software Foundation |
|
References
- https://httpd.apache.org/security/vulnerabilities_24.html
- [oss-security] 20220314 CVE-2022-22720: HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earliermailing-list
- FEDORA-2022-b4103753e9vendor-advisory
- [debian-lts-announce] 20220322 [SECURITY] [DLA 2960-1] apache2 security updatemailing-list
- FEDORA-2022-21264ec6dbvendor-advisory
- FEDORA-2022-78e3211c55vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220321-0001/
- 20220516 APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalinamailing-list
- 20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6mailing-list
- 20220516 APPLE-SA-2022-05-16-2 macOS Monterey 12.4mailing-list
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://support.apple.com/kb/HT213257
- https://support.apple.com/kb/HT213256
- https://support.apple.com/kb/HT213255
- GLSA-202208-20vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.