Vulnerability Description
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Http Server | >= 2.4.0, < 2.4.54 |
| Fedoraproject | Fedora | 35 |
| Netapp | Clustered Data Ontap | - |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2022/06/08/2Mailing ListThird Party Advisory
- https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
- https://security.gentoo.org/glsa/202208-20Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220624-0005/Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/06/08/2Mailing ListThird Party Advisory
- https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
- https://security.gentoo.org/glsa/202208-20Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220624-0005/Third Party Advisory
FAQ
What is CVE-2022-26377?
CVE-2022-26377 is a vulnerability with a CVSS score of 7.5 (HIGH). Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards reques...
How severe is CVE-2022-26377?
CVE-2022-26377 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-26377?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Http Server, Fedoraproject Fedora, Netapp Clustered Data Ontap.