Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Apache HTTP Server proxy can let attackers poison cache

CVE-2005-2088 · published 21 years ago
Summary

Versions of Apache HTTP Server older than 1.3.34 or 2.0.55 when used as a web proxy are vulnerable. An attacker can craft a request that makes the server store false pages, bypass security filters and cause users' browsers to run malicious code. Update the server to a newer version or apply the vendor's patch as soon as possible.

What to do
  • Update debian apache2 to version 2.0.54-5.
  • Update apache http_server to version 2.0.55 or later.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian apache2 < 2.0.54-5
Fix: upgrade to 2.0.54-5
Debian:13 debian apache2 < 2.0.54-5
Fix: upgrade to 2.0.54-5
Debian:14 debian apache2 < 2.0.54-5
Fix: upgrade to 2.0.54-5
– apache http_server >= 2.0.35, < 2.0.55
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
– debian debian_linux 3.0
3.1
cpe:2.3:o:debian:debian_linux:3.0:*:*:*:*:*:*:*
Original advisory text
The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct...
The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
References
Severity
4.3 Medium
Exploitation
20% chance of attack within 30 days
Type
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Timeline
Published5 Jul 2005
Updated29 Sep 2026
First seen8 Sep 2026
Sources
DEBIAN-CVE-2005-2088 · OSV
CVE-2005-2088 · NVD
Track software like this
Free during beta