Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2022-37436: Apache HTTP Server 2.4.55: Malicious Backend Truncates Response Headers
CVE-2022-37436 · published 3 years ago
Summary
A malicious server can interfere with Apache HTTP Server's response headers, potentially allowing malicious data to be sent to clients. This can lead to security issues if the affected headers are meant to protect the client. Update to Apache HTTP Server 2.4.55 or later to fix this issue.
What to do
- Update canonical apache2 to version 2.4.18-2ubuntu3.17+esm9.
- Update canonical apache2 to version 2.4.29-1ubuntu4.26.
- Update canonical apache2 to version 2.4.41-4ubuntu3.13.
- Update canonical apache2 to version 2.4.52-1ubuntu4.3.
- Update debian apache2 to version 2.4.55-1.
- Update apache http_server to version 2.4.55 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:14.04:LTS | canonical | apache2 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | apache2 |
< 2.4.18-2ubuntu3.17+esm9 Fix: upgrade to 2.4.18-2ubuntu3.17+esm9
|
| Ubuntu:18.04:LTS | canonical | apache2 |
< 2.4.29-1ubuntu4.26 Fix: upgrade to 2.4.29-1ubuntu4.26
|
| Ubuntu:20.04:LTS | canonical | apache2 |
< 2.4.41-4ubuntu3.13 Fix: upgrade to 2.4.41-4ubuntu3.13
|
| Ubuntu:22.04:LTS | canonical | apache2 |
< 2.4.52-1ubuntu4.3 Fix: upgrade to 2.4.52-1ubuntu4.3
|
| – | apache | http_server |
< 2.4.55 cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* |
| Debian:12 | debian | apache2 |
< 2.4.55-1 Fix: upgrade to 2.4.55-1
|
Original advisory text
Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting
Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.
References
- https://ubuntu.com/security/CVE-2022-37436 Third Party Advisory
- https://www.openwall.com/lists/oss-security/2023/01/17/7 Third Party Advisory
- https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-37436 Third Party Advisory
- https://ubuntu.com/security/notices/USN-5839-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-5839-2 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-37436 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37436... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-37436 Vendor Advisory
- https://security.gentoo.org/glsa/202309-01 Vendor Advisory
- https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-37436 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CWE-436Interpretation Conflict
Timeline
Published17 Jan 2023
Updated3 Nov 2026
First seen22 Jul 2026
Sources
UBUNTU-CVE-2022-37436 · OSV
CVE-2022-37436 · OSV
CVE-2022-37436 · NVD
DEBIAN-CVE-2022-37436 · OSV
Track software like this
Free during beta