CVE-2015-3183

Apache HTTP Server 2.2.0-2.2.30 - HTTP Request Smuggling via Chunked Transfer Coding

Title source: llm

Description

The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.

References (53)

Core 53

Core References

Mailing List, Third Party Advisory, VDB Entry vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=144493176821532&w=2

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-2056.html

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html

Vendor Advisory x_refsource_confirm

http://httpd.apache.org/security/vulnerabilities_24.html

Patch x_refsource_confirm

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-0061.html

Third Party Advisory, VDB Entry x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Patch, Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2015-1667.html

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-0062.html

Vendor Advisory x_refsource_confirm

http://www.apache.org/dist/httpd/CHANGES_2.4

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2015-1666.html

Third Party Advisory x_refsource_confirm

https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1032967

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2015-1668.html

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2015-2661.html

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-2055.html

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-2686-1

Mailing List vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/75963

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2015/dsa-3325

Third Party Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2015:2659

Third Party Advisory x_refsource_confirm

https://github.com/apache/httpd/commit/e427c41257957b57036d5a549b260b6185d1dd73

View Writeup ZIP pw:eip

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/91787

Third Party Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2015:2660

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-2054.html

Third Party Advisory, VDB Entry x_refsource_confirm

https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789

Mailing List vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html

Third Party Advisory x_refsource_confirm

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735

Mailing List, Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E

Third Party Advisory x_refsource_confirm

https://github.com/apache/httpd/commit/a6027e56924bb6227c1fdbf6f91e7e2438338be6

View Writeup ZIP pw:eip

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/201610-02

Third Party Advisory x_refsource_confirm

https://puppet.com/security/cve/CVE-2015-3183

Third Party Advisory, VDB Entry x_refsource_confirm

https://support.apple.com/kb/HT205031

Third Party Advisory, VDB Entry x_refsource_confirm

https://support.apple.com/HT205219

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

Third Party Advisory mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

Scores

EPSS 0.2412

EPSS Percentile 96.2%

Details

CWE

CWE-17 CWE-20

Status published

Products (1)

apache/http_server 2.2.0 - 2.2.31

Published Jul 20, 2015

Tracked Since Feb 18, 2026