{"id":"CVE-2022-22720","published":"2022-03-14T10:15:29Z","modified":"2024-08-03T03:21:48Z","title":"HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier","vendor":"Apache Software Foundation","product":"Apache HTTP Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache HTTP Server","versions":[">= Apache HTTP Server 2.4, <= 2.4.52"]}],"description":{"text":"Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw lies in Apache HTTP Server, versions 2.4.52 and earlier, where the server fails to close an inbound connection when errors occur while discarding the request body. An attacker who can send crafted HTTP requests to a vulnerable server can exploit this to perform HTTP request smuggling, with the attack vector and any required authentication, user interaction, or configuration conditions not specified in the available information.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:18:23Z"},"cvss":null,"epss":{"score":0.28189,"percentile":0.98112,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"}],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["x_refsource_MISC"]},{"url":"http://www.openwall.com/lists/oss-security/2022/03/14/3","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20220321-0001/","tags":["x_refsource_CONFIRM"]},{"url":"http://seclists.org/fulldisclosure/2022/May/33","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://seclists.org/fulldisclosure/2022/May/35","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://seclists.org/fulldisclosure/2022/May/38","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC"]},{"url":"https://support.apple.com/kb/HT213257","tags":["x_refsource_CONFIRM"]},{"url":"https://support.apple.com/kb/HT213256","tags":["x_refsource_CONFIRM"]},{"url":"https://support.apple.com/kb/HT213255","tags":["x_refsource_CONFIRM"]},{"url":"https://security.gentoo.org/glsa/202208-20","tags":["vendor-advisory","x_refsource_GENTOO"]}],"techniques":[],"reports":[{"id":"SRC-b804e28bf5894dd4955f","title":"Whitepaper Name Goes","publisher":"trustwave.com","url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/Trustwave_SpiderLabs_2023_Hospitality_Sector_Threat_Landscape.pdf","date":null,"mentions":[{"quote":"DoS (CVE-2006-20001)\r\n▪ Mod_proxy module of httpd (CVE-2022-37436)\r\n▪ SQLite DoS vulnerability (CVE-2019-20372)\r\n▪ Jenkins RCE (CVE-2017-20005)\r\n▪ Nginx web server DoS (CVE-2017-7529)\r\n▪ Spring Framework RCE (CVE-2016-1247)\r\n▪ Apache HTTP Server DoS (CVE-2022-22719)\r\n▪ Apache HTTP Request Smuggling (CVE-2022-22720)","start":45625,"end":45941}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-27863","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-27863","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-03-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-22720","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":23.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.62,"detail":"percentile 0.9811"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}