CVE-2022-22720

CRITICAL LAB

Apache HTTP Server < 2.4.52 - HTTP Request Smuggling

Title source: rule

Description

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

Exploits (1)

nomisec STUB
by Benasin · poc
https://github.com/Benasin/CVE-2022-22720

References (16)

Scores

CVSS v3 9.8
EPSS 0.2746
EPSS Percentile 96.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Lab Environment

COMMUNITY
Community Lab
docker pull httpd:2.4.52

Details

CWE
CWE-444
Status published
Products (11)
apache/http_server < 2.4.52
apple/macos < 10.15.7
apple/mac_os_x 10.15.7 security_update_2020-001 (12 CPE variants)
debian/debian_linux 9.0
fedoraproject/fedora 34
fedoraproject/fedora 35
fedoraproject/fedora 36
oracle/enterprise_manager_ops_center 12.4.0.0
oracle/http_server 12.2.1.3.0
oracle/http_server 12.2.1.4.0
... and 1 more
Published Mar 14, 2022
Tracked Since Feb 18, 2026