CVE-2022-26377: apache software foundation apache http server HTTP Request/Response Smuggling
Vulnerability summary
CVE-2022-26377 is a high (CVSS 7.5) HTTP Request/Response Smuggling vulnerability in apache software foundation apache http server. EPSS estimates a 21.08% chance of exploitation in the next 30 days, higher than 97.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 14 · Related 10Timeline
- 08-06-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
21.08%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 21.08% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- apache2< 2.4.54-r0
Apache1 product
- http_server≥ 2.4.0, < 2.4.54
Apache software foundation1 product
- apache http server≥ Apache HTTP Server 2.4, ≤ 2.4.53
Debian1 product
- apache2< 2.4.54-1
Fedoraproject1 product
- fedoraEOL35 | 36
Netapp1 product
Ubuntu1 product
- apache2< 2.4.7-1ubuntu4.22+esm5 | < 2.4.18-2ubuntu3.17+esm6 | < 2.4.29-1ubuntu4.24 | < 2.4.41-4ubuntu3.12 | < 2.4.52-1ubuntu4.1
7 vendors · 7 products
