CVE-2022-22720

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
HTTP Request/Response Smuggling
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
apacheCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 96%
VendorProductVersion
apachehttp_server
𝑥
≤ 2.4.52
debiandebian_linux
9.0
oracleenterprise_manager_ops_center
12.4.0.0
oraclehttp_server
12.2.1.3.0
oraclehttp_server
12.2.1.4.0
oraclezfs_storage_appliance_kit
8.8
applemac_os_x
10.15.7:security_update_2020-001
applemac_os_x
10.15.7:security_update_2021-001
applemac_os_x
10.15.7:security_update_2021-002
applemac_os_x
10.15.7:security_update_2021-003
applemac_os_x
10.15.7:security_update_2021-004
applemac_os_x
10.15.7:security_update_2021-005
applemac_os_x
10.15.7:security_update_2021-006
applemac_os_x
10.15.7:security_update_2021-007
applemac_os_x
10.15.7:security_update_2021-008
applemac_os_x
10.15.7:security_update_2022-001
applemac_os_x
10.15.7:security_update_2022-002
applemac_os_x
10.15.7:security_update_2022-003
applemacos
𝑥
< 10.15.7
applemacos
11.0 ≤
𝑥
< 11.6.6
applemacos
12.0 ≤
𝑥
≤ 12.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
apache2
bullseye
2.4.62-1~deb11u1
fixed
bullseye (security)
2.4.62-1~deb11u2
fixed
bookworm
2.4.62-1~deb12u1
fixed
bookworm (security)
2.4.62-1~deb12u2
fixed
sid
2.4.62-3
fixed
trixie
2.4.62-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
apache2
jammy
Fixed 2.4.52-1ubuntu2
released
impish
Fixed 2.4.48-3.1ubuntu3.3
released
focal
Fixed 2.4.41-4ubuntu3.10
released
bionic
Fixed 2.4.29-1ubuntu4.22
released
xenial
Fixed 2.4.18-2ubuntu3.17+esm5
released
trusty
Fixed 2.4.7-1ubuntu4.22+esm4
released
References