CVE-2022-22720
published 2022-03-14CVE-2022-22720: Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP…
PriorityP266critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
28.19%
97.9th percentile
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | <= 2.4.52 | — |
| apache_software_foundation | apache_http_server | Apache HTTP Server 2.4 – 2.4.52 | — |
| apple | mac_os_x | — | — |
| apple | macos | < 10.15.7 | 10.15.7 |
| apple | macos | >= 11.0 < 11.6.6 | 11.6.6 |
| apple | macos | 12.0 – 12.4 | — |
| apple | macos_big_sur | — | — |
| apple | macos_monterey | — | — |
| apple | security_update_2022-004_catalina | — | — |
| debian | apache2 | < apache2 2.4.53-1 (bookworm) | apache2 2.4.53-1 (bookworm) |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cbl2_httpd_2.4.53-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_httpd_2.4.53-1_on_cbl_mariner_1.0 | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | http_server | — | — |
| oracle | http_server | — | — |
| oracle | zfs_storage_appliance_kit | — | — |
| paloalto | pan-os | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Target: Apache HTTP Server versions 2.4.52 and earlier are vulnerable to HTTP Request Smuggling due to failure to close inbound connection when errors are encountered discarding the request body ↗
- →Detection focus: Monitor for HTTP Request Smuggling patterns against Apache httpd — specifically cases where the server does not close the inbound connection after a request body discard error, which may allow a second smuggled request to be interpreted ↗
- ·No known mitigations exist for this vulnerability; patching to Apache HTTP Server 2.4.53 or later is the only resolution ↗
- ·Red Hat Enterprise Linux 9 ships httpd marked as 'Not affected'; Red Hat JBoss Enterprise Application Platform 6 is out of support scope — verify affected package versions per distribution ↗
- ·Debian fixed the vulnerability in Apache 2.4.53-1 across bookworm, bullseye, forky, sid, and trixie — systems running earlier Debian packages remain exposed ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_msrc9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
vendor_paloalto·2024-04-10·CVSS 9.8
CVE-2015-5739 [CRITICAL] PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS. While it was not determined that these CVEs have any significant impact on PAN-OS, they have been fixed out of an abundance of caution. CVE Summary CVE-2015-5739 This CVE is fixed in PAN-OS 11.0.4, and all later PAN-OS versions. CVE-2016-10228 This CVE is fixed in PAN-OS 11.1.3, and all later PAN-OS versions. CVE-2017-8923 This CVE is fixed in PAN-OS 10.2.8, 11.0.3, and all later PAN-OS versions. CVE-2017-9120 This CVE is fixed in PAN-OS 10.2.8, 11.0.3, and all later PAN-OS versions. CVE-2018-25009 This CVE is fixed in PAN-OS 10.2.8, 11.0.4, 11.1.3, and all later PAN-OS versions. CVE-2
Apple
CVE-2022-22720: macOS Big Sur 11.6.6
vendor_apple·2022-05-16·CVSS 9.8
CVE-2022-22720 [CRITICAL] CVE-2022-22720: macOS Big Sur 11.6.6
Apple Security Update: About the security content of macOS Big Sur 11.6.6
Product: macOS Big Sur
Version: 11.6.6
CVE: CVE-2022-22720
Component: CVE-2022-22720
Apple
CVE-2022-22720: Security Update 2022-004 Catalina
vendor_apple·2022-05-16·CVSS 9.8
CVE-2022-22720 [CRITICAL] CVE-2022-22720: Security Update 2022-004 Catalina
Apple Security Update: About the security content of Security Update 2022-004 Catalina
Product: Security Update 2022-004 Catalina
CVE: CVE-2022-22720
Component: CVE-2022-22720
Apple
CVE-2022-22720: macOS Monterey 12.4
vendor_apple·2022-05-16·CVSS 9.8
CVE-2022-22720 [CRITICAL] CVE-2022-22720: macOS Monterey 12.4
Apple Security Update: About the security content of macOS Monterey 12.4
Product: macOS Monterey
Version: 12.4
CVE: CVE-2022-22720
Component: CVE-2022-22720
CISA ICS
Mitsubishi Electric MELSOFT iQ AppPortal
cisa_ics·2022-05-12·CVSS 5.5
[MEDIUM] Mitsubishi Electric MELSOFT iQ AppPortal
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Mitsubishi Electric MELSOFT iQ AppPortal
Last RevisedMay 12, 2022
Alert CodeICSA-22-132-02
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Mitsubishi Electric
- Equipment: MELSOFT iQ AppPortal
- Vulnerabilities: Missing Authorization, Out-of-bounds Write, NULL Pointer Dereference, Classic Buffer Overflow, HTTP Request Smuggling, Infinite Loop
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in a denial-of-service condition, malicious program execution, information disclosure, informa
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2022-03-17·CVSS 7.5
CVE-2022-22721 [HIGH] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
USN-5333-1 fixed several vulnerabilities in Apache. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
Chamal De Silva discovered that the Apache HTTP Server mod_lua module
incorrectly handled certain crafted request bodies. A remote attacker could
possibly use this issue to cause the server to crash, resulting in a denial
of service. (CVE-2022-22719)
James Kettle discovered that the Apache HTTP Server incorrectly closed
inbound connection when certain errors are encountered. A remote attacker
could possibly use this issue to perform an HTTP Request Smuggling attack.
(CVE-2022-22720)
It was discovered that the Ap
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2022-03-17·CVSS 7.5
CVE-2022-22719 [HIGH] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
Chamal De Silva discovered that the Apache HTTP Server mod_lua module
incorrectly handled certain crafted request bodies. A remote attacker could
possibly use this issue to cause the server to crash, resulting in a denial
of service. (CVE-2022-22719)
James Kettle discovered that the Apache HTTP Server incorrectly closed
inbound connection when certain errors are encountered. A remote attacker
could possibly use this issue to perform an HTTP Request Smuggling attack.
(CVE-2022-22720)
It was discovered that the Apache HTTP Server incorrectly handled large
LimitXMLRequestBody settings on certain platforms. In certain
configurations, a remote attacker could use this issue to cause t
Red Hat
httpd: Errors encountered during the discarding of request body lead to HTTP request smuggling
vendor_redhat·2022-03-14·CVSS 9.8
CVE-2022-22720 [CRITICAL] CWE-444 httpd: Errors encountered during the discarding of request body lead to HTTP request smuggling
httpd: Errors encountered during the discarding of request body lead to HTTP request smuggling
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
A flaw was found in httpd. The inbound connection is not closed when it fails to discard the request body, which may expose the server to HTTP request smuggling.
Mitigation: There are currently no known mitigations for this issue.
Package: httpd (Red Hat Enterprise Linux 9) - Not affected
Package: httpd (Red Hat JBoss Enterprise Application Platform 6) - Out of support scope
Microsoft
HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier
vendor_msrc·2022-03-08·CVSS 9.8
CVE-2022-22720 [CRITICAL] CWE-444 HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier
HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
apache: apache
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Debian
CVE-2022-22720: apache2 - Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when err...
vendor_debian·2022·CVSS 9.8
CVE-2022-22720 [CRITICAL] CVE-2022-22720: apache2 - Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when err...
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
Scope: local
bookworm: resolved (fixed in 2.4.53-1)
bullseye: resolved (fixed in 2.4.53-1~deb11u1)
forky: resolved (fixed in 2.4.53-1)
sid: resolved (fixed in 2.4.53-1)
trixie: resolved (fixed in 2.4.53-1)
OSV
apache2 vulnerabilities
osv·2022-03-17·CVSS 7.5
CVE-2022-22719 [HIGH] apache2 vulnerabilities
apache2 vulnerabilities
Chamal De Silva discovered that the Apache HTTP Server mod_lua module
incorrectly handled certain crafted request bodies. A remote attacker could
possibly use this issue to cause the server to crash, resulting in a denial
of service. (CVE-2022-22719)
James Kettle discovered that the Apache HTTP Server incorrectly closed
inbound connection when certain errors are encountered. A remote attacker
could possibly use this issue to perform an HTTP Request Smuggling attack.
(CVE-2022-22720)
It was discovered that the Apache HTTP Server incorrectly handled large
LimitXMLRequestBody settings on certain platforms. In certain
configurations, a remote attacker could use this issue to cause the server
to crash, resulting in a denial of service, or possibly execute arbitrary
co
OSV
apache2 vulnerabilities
osv·2022-03-17·CVSS 7.5
CVE-2022-22719 [HIGH] apache2 vulnerabilities
apache2 vulnerabilities
USN-5333-1 fixed several vulnerabilities in Apache. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
Chamal De Silva discovered that the Apache HTTP Server mod_lua module
incorrectly handled certain crafted request bodies. A remote attacker could
possibly use this issue to cause the server to crash, resulting in a denial
of service. (CVE-2022-22719)
James Kettle discovered that the Apache HTTP Server incorrectly closed
inbound connection when certain errors are encountered. A remote attacker
could possibly use this issue to perform an HTTP Request Smuggling attack.
(CVE-2022-22720)
It was discovered that the Apache HTTP Server incorrectly handled large
LimitXMLRequestBody settings on certain pla
GHSA
GHSA-2hwm-6xjf-3xmx: Apache HTTP Server 2
ghsa_unreviewed·2022-03-15
CVE-2022-22720 [CRITICAL] CWE-444 GHSA-2hwm-6xjf-3xmx: Apache HTTP Server 2
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
OSV
CVE-2022-22720: Apache HTTP Server 2
osv·2022-03-14·CVSS 9.8
CVE-2022-22720 [CRITICAL] CVE-2022-22720: Apache HTTP Server 2
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
No detection rules found.
No public exploits indexed.
arXiv
Plug. Play. Persist. Inside a Ready-to-Go Havoc C2 Infrastructure
arxiv_fulltext·2025-06-30·CVSS 9.8
[CRITICAL] Plug. Play. Persist. Inside a Ready-to-Go Havoc C2 Infrastructure
titlepage
*1cm
Plug. Play. Persist. Inside a Ready-to-Go Havoc C2 Infrastructure \ 1cm]
Alessio Di Santo ([email protected])
Università degli Studi dell’Aquila, L’Aquila, Abruzzo, Italy
Date: July 1,2025
!60 "Non videmus ea quae mox futura sunt" \ 0.5cm]
!60(We do not see the things that will soon be) — Marcus Tullius Cicero
titlepage
## Executive Summary
This analysis focuses on a single Azure-hosted Virtual Machine at 52.230.23[.]114 that the adversary converted into an all-in-one delivery, staging and Command-and-Control node. The host advertises an out-of-date Apache 2.4.52 instance whose open directory exposes phishing lures, PowerShell loaders, Reflective Shell-Code, compiled Havoc Demon implants and a toolbox of lateral-movement binaries; the same server als
HackerOne
Pause-based desync in Apache HTTPD
hackerone·2022-08-25·CVSS 9.8
[CRITICAL] Pause-based desync in Apache HTTPD
Pause-based desync in Apache HTTPD
Apache was vulnerable to a pause-based desync. This vulnerability is described in detail in my whitepaper here: https://portswigger.net/research/browser-powered-desync-attacks#pause
## Impact
This enables server-side HTTP Request Smuggling when Apache is deployed as a back-end server, and it also enables MITM attackers to inject arbitrary JavaScript in spite of TLS.
important: HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier (CVE-2022-22720)
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
Acknowledgements: James Kettle
Reported to security team: 2021-12-17
fixed by r1898692 in 2.4.x: 2022-03-07
http://seclists.org/fulldisclosure/2022/May/33http://seclists.org/fulldisclosure/2022/May/35http://seclists.org/fulldisclosure/2022/May/38http://www.openwall.com/lists/oss-security/2022/03/14/3https://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.debian.org/debian-lts-announce/2022/03/msg00033.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/https://security.gentoo.org/glsa/202208-20https://security.netapp.com/advisory/ntap-20220321-0001/https://support.apple.com/kb/HT213255https://support.apple.com/kb/HT213256https://support.apple.com/kb/HT213257https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttp://seclists.org/fulldisclosure/2022/May/33http://seclists.org/fulldisclosure/2022/May/35http://seclists.org/fulldisclosure/2022/May/38http://www.openwall.com/lists/oss-security/2022/03/14/3https://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.debian.org/debian-lts-announce/2022/03/msg00033.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/https://security.gentoo.org/glsa/202208-20https://security.netapp.com/advisory/ntap-20220321-0001/https://support.apple.com/kb/HT213255https://support.apple.com/kb/HT213256https://support.apple.com/kb/HT213257https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.html
2022-03-14
Published