Vulnerability · Published Mar 14, 2022 · Assigned by apache
CVE-2022-22720HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier
Critical 9.8
In plain English
A critical-severity security flaw in Apache HTTP Server from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 28.2% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)28.2%top 1.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | httpd | 2.4.37-43.module_el8.5.0+2631+6f259f31.3.alma | ALSA-2022:1049 |
| AlmaLinux:8 | httpd-devel | 2.4.37-43.module_el8.5.0+2631+6f259f31.3.alma | ALSA-2022:1049 |
| AlmaLinux:8 | httpd-filesystem | 2.4.37-43.module_el8.5.0+2631+6f259f31.3.alma | ALSA-2022:1049 |
| AlmaLinux:8 | httpd-manual | 2.4.37-43.module_el8.5.0+2631+6f259f31.3.alma | ALSA-2022:1049 |
| AlmaLinux:8 | httpd-tools | 2.4.37-43.module_el8.5.0+2631+6f259f31.3.alma | ALSA-2022:1049 |
| AlmaLinux:8 | mod_ldap | 2.4.37-43.module_el8.5.0+2631+6f259f31.3.alma | ALSA-2022:1049 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa | ALSA-2022:1049 |
| AlmaLinux:8 | mod_proxy_html | 1:2.4.37-43.module_el8.5.0+2631+6f259f31.3.alma | ALSA-2022:1049 |
| AlmaLinux:8 | mod_session | 2.4.37-43.module_el8.5.0+2631+6f259f31.3.alma | ALSA-2022:1049 |
| AlmaLinux:8 | mod_ssl | 1:2.4.37-43.module_el8.5.0+2631+6f259f31.3.alma | ALSA-2022:1049 |
| Alpine:v3.20 | apache2 | 2.4.53-r0 | ALPINE-CVE-2022-22720 |
| Alpine:v3.21 | apache2 | 2.4.53-r0 | ALPINE-CVE-2022-22720 |
| Alpine:v3.22 | apache2 | 2.4.53-r0 | ALPINE-CVE-2022-22720 |
| Alpine:v3.23 | apache2 | 2.4.53-r0 | ALPINE-CVE-2022-22720 |
| Alpine:v3.24 | apache2 | 2.4.53-r0 | ALPINE-CVE-2022-22720 |
| Debian:12 | apache2 | 2.4.53-1 | DEBIAN-CVE-2022-22720 |
| Debian:13 | apache2 | 2.4.53-1 | DEBIAN-CVE-2022-22720 |
| Debian:14 | apache2 | 2.4.53-1 | DEBIAN-CVE-2022-22720 |
| Rocky Linux:8 | httpd | 0:2.4.37-43.module+el8.5.0+714+5ec56ee8 | RLSA-2022:1049 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-3.module+el8.5.0+695+1fa8055e | RLSA-2022:1049 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-3.module+el8.4.0+553+7a69454b | RLSA-2022:1049 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.4.0+553+7a69454b | RLSA-2022:1049 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.5.0+695+1fa8055e | RLSA-2022:1049 |
| Ubuntu:22.04:LTS | apache2 | 2.4.52-1ubuntu2 | UBUNTU-CVE-2022-22720 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache HTTP Server | Apache HTTP Server 2.4 – through 2.4.52 |
Weakness: CWE-444
References
- https://httpd.apache.org/security/vulnerabilities_24.html x_refsource_MISC
- [oss-security] 20220314 CVE-2022-22720: HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier mailing-list, x_refsource_MLIST
- FEDORA-2022-b4103753e9 vendor-advisory, x_refsource_FEDORA
- [debian-lts-announce] 20220322 [SECURITY] [DLA 2960-1] apache2 security update mailing-list, x_refsource_MLIST
- FEDORA-2022-21264ec6db vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-78e3211c55 vendor-advisory, x_refsource_FEDORA
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20220321-0001/ x_refsource_CONFIRM
- 20220516 APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalina mailing-list, x_refsource_FULLDISC
- 20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6 mailing-list, x_refsource_FULLDISC
- 20220516 APPLE-SA-2022-05-16-2 macOS Monterey 12.4 mailing-list, x_refsource_FULLDISC
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC
- https://support.apple.com/kb/HT213257 x_refsource_CONFIRM
- https://support.apple.com/kb/HT213256 x_refsource_CONFIRM
- https://support.apple.com/kb/HT213255 x_refsource_CONFIRM
- GLSA-202208-20 vendor-advisory, x_refsource_GENTOO