CVE-2022-36760

CRITICAL

Apache HTTP Server < 2.4.55 - HTTP Request Smuggling

Title source: rule
STIX 2.1

Description

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.

References (2)

Scores

CVSS v3 9.0
EPSS 0.0029
EPSS Percentile 52.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-444
Status published
Products (1)
apache/http_server 2.4.0 - 2.4.55
Published Jan 17, 2023
Tracked Since Feb 18, 2026