CVE-2022-22720

Published: Mar 14, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

Affected (24)

Products: Apache: Http Server · Fedoraproject: Fedora · Debian: Debian Linux · +2 more

Show all products

Apache: Http Server · Fedoraproject: Fedora · Debian: Debian Linux · Oracle: Enterprise Manager Ops Center, Http Server, Zfs Storage Appliance Kit · Apple: Mac Os X, Macos

1 product

1 product

1 product

3 products

Enterprise Manager Ops Center

Zfs Storage Appliance Kit

2 products

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	Up to 2.4.52

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 34
Fedoraproject Fedora	Version 35
Fedoraproject Fedora	Version 36

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Oracle Enterprise Manager Ops Center	Version 12.4.0.0
Oracle Http Server	Version 12.2.1.3.0
Oracle Http Server	Version 12.2.1.4.0
Oracle Zfs Storage Appliance Kit	Version 8.8

Configuration E

15 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	Version 10.15.7 security_update_2020-001
Apple Mac Os X	Version 10.15.7 security_update_2021-001
Apple Mac Os X	Version 10.15.7 security_update_2021-002
Apple Mac Os X	Version 10.15.7 security_update_2021-003
Apple Mac Os X	Version 10.15.7 security_update_2021-004
Apple Mac Os X	Version 10.15.7 security_update_2021-005
Apple Mac Os X	Version 10.15.7 security_update_2021-006
Apple Mac Os X	Version 10.15.7 security_update_2021-007
Apple Mac Os X	Version 10.15.7 security_update_2021-008
Apple Mac Os X	Version 10.15.7 security_update_2022-001
Apple Mac Os X	Version 10.15.7 security_update_2022-002
Apple Mac Os X	Version 10.15.7 security_update_2022-003
Apple Macos	Before 10.15.7
Apple Macos	From 11.0 to 11.6.6
Apple Macos	From 12.0 to 12.4

Related CWEs

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

References (32)

http://seclists.org/fulldisclosure/2022/May/33

Source: security@apache.org

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/May/35

Source: security@apache.org

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/May/38

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/03/14/3

Source: security@apache.org

Mailing ListThird Party Advisory

https://httpd.apache.org/security/vulnerabilities_24.html

Source: security@apache.org

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/

Source: security@apache.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/

Source: security@apache.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/

Source: security@apache.org

https://security.gentoo.org/glsa/202208-20

Source: security@apache.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20220321-0001/

Source: security@apache.org

Third Party Advisory

https://support.apple.com/kb/HT213255

Source: security@apache.org

Third Party Advisory

https://support.apple.com/kb/HT213256

Source: security@apache.org

Third Party Advisory

https://support.apple.com/kb/HT213257

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: security@apache.org

Third Party Advisory

http://seclists.org/fulldisclosure/2022/May/33

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/May/35

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/May/38

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/03/14/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://httpd.apache.org/security/vulnerabilities_24.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202208-20

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20220321-0001/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.apple.com/kb/HT213255

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.apple.com/kb/HT213256

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.apple.com/kb/HT213257

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.