CVE-2022-22720

CRITICAL severity · CVSS 9.8 · CWE-444

9.8CVSS CRITICAL

Summary

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)27%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

Apache HTTP Server

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
https://httpd.apache.org/security/vulnerabilities_24.htmlAdvisory
http://seclists.org/fulldisclosure/2022/May/33Advisory
http://seclists.org/fulldisclosure/2022/May/35Advisory
http://seclists.org/fulldisclosure/2022/May/38Advisory
http://www.openwall.com/lists/oss-security/2022/03/14/3Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00033.htmlAdvisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/