CVE-2022-26377

HIGH 7.5CVE-2022-26377 · Published 09/06/2022 · updated 17/06/2026

In short

CVE-2022-26377 is a HIGH (CVSS 7.5) vulnerability affecting http server (apache).
Chance of exploitation in the next 30 days (EPSS): 21.1%, higher than 97.6% of all vulnerabilities.
Fix: update to 2.4.54 or later.

Package	Affected versions	Patched versions
http server apache	`≥ 2.4.0, < 2.4.54`	`2.4.54`

Description

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.

References

openwall.com/lists/oss-security/2022/06/08/2 · Mailing List
httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ · Third Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND · Third Party Advisory
security.gentoo.org/glsa/202208-20 · Third Party Advisory
security.netapp.com/advisory/ntap-20220624-0005 · Third Party Advisory

More vulnerabilities in http server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

http server

apache

≥ 2.4.0, < 2.4.54

2.4.54

Description

More vulnerabilities in http server

See all →