p PatchFirst

CVE-2022-36760

CVE-2022-36760 · Apache HTTP Server: mod_proxy_ajp Possible request smuggling

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.

CVSS 9.0 · Critical · EPSS 1.9% · Fix available

Published
Updated

Stack: system · web

Affected products and versions

  • apache httpd

    Versions
    • ≥ 2.4, ≤ 2.4.54: Affected (semver)

    No fix published

  • apache2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.4.55-1

    Update to 2.4.55-1

  • apache2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.4.55-1

    Update to 2.4.55-1

  • apache2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.4.55-1

    Update to 2.4.55-1

  • apache2 Ubuntu:Pro:14.04:LTS

    Versions
    • 2.4.6-2ubuntu2
    • 2.4.6-2ubuntu3
    • 2.4.6-2ubuntu4
    • 2.4.7-1ubuntu1
    • 2.4.7-1ubuntu2
    • 2.4.7-1ubuntu3
    • 2.4.7-1ubuntu4
    • 2.4.7-1ubuntu4.1
    • 2.4.7-1ubuntu4.4
    • 2.4.7-1ubuntu4.5
    • 2.4.7-1ubuntu4.6
    • 2.4.7-1ubuntu4.7
    • 2.4.7-1ubuntu4.8
    • 2.4.7-1ubuntu4.9
    • 2.4.7-1ubuntu4.10
    • 2.4.7-1ubuntu4.11
    • 2.4.7-1ubuntu4.13
    • 2.4.7-1ubuntu4.15
    • 2.4.7-1ubuntu4.16
    • 2.4.7-1ubuntu4.17
    • 2.4.7-1ubuntu4.18
    • 2.4.7-1ubuntu4.19
    • 2.4.7-1ubuntu4.20
    • 2.4.7-1ubuntu4.21
    • 2.4.7-1ubuntu4.22
    • 2.4.7-1ubuntu4.22+esm1
    • 2.4.7-1ubuntu4.22+esm2
    • 2.4.7-1ubuntu4.22+esm3
    • 2.4.7-1ubuntu4.22+esm4
    • 2.4.7-1ubuntu4.22+esm5
    • 2.4.7-1ubuntu4.22+esm6
    • 2.4.7-1ubuntu4.22+esm8
    • 2.4.7-1ubuntu4.22+esm9
    • 2.4.7-1ubuntu4.22+esm10
    • 2.4.7-1ubuntu4.22+esm12
    • 2.4.7-1ubuntu4.22+esm13
    • 2.4.7-1ubuntu4.22+esm14
    • 2.4.7-1ubuntu4.22+esm15
    • 2.4.7-1ubuntu4.22+esm16
    • 2.4.7-1ubuntu4.22+esm17
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • apache2 Ubuntu:Pro:16.04:LTS

    Versions
    • 2.4.12-2ubuntu2
    • 2.4.17-1ubuntu1
    • 2.4.17-2ubuntu1
    • 2.4.17-3ubuntu1
    • 2.4.18-1ubuntu1
    • 2.4.18-2ubuntu1
    • 2.4.18-2ubuntu2
    • 2.4.18-2ubuntu3
    • 2.4.18-2ubuntu3.1
    • 2.4.18-2ubuntu3.2
    • 2.4.18-2ubuntu3.3
    • 2.4.18-2ubuntu3.4
    • 2.4.18-2ubuntu3.5
    • 2.4.18-2ubuntu3.7
    • 2.4.18-2ubuntu3.8
    • 2.4.18-2ubuntu3.9
    • 2.4.18-2ubuntu3.10
    • 2.4.18-2ubuntu3.12
    • 2.4.18-2ubuntu3.13
    • 2.4.18-2ubuntu3.14
    • 2.4.18-2ubuntu3.15
    • 2.4.18-2ubuntu3.17
    • 2.4.18-2ubuntu3.17+esm1
    • 2.4.18-2ubuntu3.17+esm2
    • 2.4.18-2ubuntu3.17+esm3
    • 2.4.18-2ubuntu3.17+esm4
    • 2.4.18-2ubuntu3.17+esm5
    • 2.4.18-2ubuntu3.17+esm6
    • 2.4.18-2ubuntu3.17+esm7
    Affected ranges
    • ECOSYSTEM: < 2.4.18-2ubuntu3.17+esm8

    Update to 2.4.18-2ubuntu3.17+esm8

  • apache2 Ubuntu:18.04:LTS

    Versions
    • 2.4.27-2ubuntu3
    • 2.4.29-1ubuntu1
    • 2.4.29-1ubuntu2
    • 2.4.29-1ubuntu3
    • 2.4.29-1ubuntu4
    • 2.4.29-1ubuntu4.1
    • 2.4.29-1ubuntu4.2
    • 2.4.29-1ubuntu4.3
    • 2.4.29-1ubuntu4.4
    • 2.4.29-1ubuntu4.5
    • 2.4.29-1ubuntu4.6
    • 2.4.29-1ubuntu4.7
    • 2.4.29-1ubuntu4.8
    • 2.4.29-1ubuntu4.10
    • 2.4.29-1ubuntu4.11
    • 2.4.29-1ubuntu4.12
    • 2.4.29-1ubuntu4.13
    • 2.4.29-1ubuntu4.14
    • 2.4.29-1ubuntu4.16
    • 2.4.29-1ubuntu4.17
    • 2.4.29-1ubuntu4.18
    • 2.4.29-1ubuntu4.19
    • 2.4.29-1ubuntu4.20
    • 2.4.29-1ubuntu4.21
    • 2.4.29-1ubuntu4.22
    • 2.4.29-1ubuntu4.23
    • 2.4.29-1ubuntu4.24
    • 2.4.29-1ubuntu4.25
    Affected ranges
    • ECOSYSTEM: < 2.4.29-1ubuntu4.26

    Update to 2.4.29-1ubuntu4.26

  • apache2 Ubuntu:20.04:LTS

    Versions
    • 2.4.41-1ubuntu1
    • 2.4.41-4ubuntu1
    • 2.4.41-4ubuntu2
    • 2.4.41-4ubuntu3
    • 2.4.41-4ubuntu3.1
    • 2.4.41-4ubuntu3.3
    • 2.4.41-4ubuntu3.4
    • 2.4.41-4ubuntu3.5
    • 2.4.41-4ubuntu3.6
    • 2.4.41-4ubuntu3.7
    • 2.4.41-4ubuntu3.8
    • 2.4.41-4ubuntu3.9
    • 2.4.41-4ubuntu3.10
    • 2.4.41-4ubuntu3.11
    • 2.4.41-4ubuntu3.12
    Affected ranges
    • ECOSYSTEM: < 2.4.41-4ubuntu3.13

    Update to 2.4.41-4ubuntu3.13

  • apache2 Ubuntu:22.04:LTS

    Versions
    • 2.4.48-3.1ubuntu3
    • 2.4.48-3.1ubuntu4
    • 2.4.51-2ubuntu1
    • 2.4.52-1ubuntu1
    • 2.4.52-1ubuntu2
    • 2.4.52-1ubuntu4
    • 2.4.52-1ubuntu4.1
    • 2.4.52-1ubuntu4.2
    Affected ranges
    • ECOSYSTEM: < 2.4.52-1ubuntu4.3

    Update to 2.4.52-1ubuntu4.3

Original sources

Check your server →