CVE-2022-26377 mod_proxy_ajp: Possible request smuggling
Attackers can smuggle requests to the AJP server via mod_proxy_ajp, potentially bypassing security controls or accessing unauthorized data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-26377?
CVE-2022-26377 is a high-severity vulnerability in Apache Http Server, published on 8 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.
Weakness: CWE-444
Which versions are affected by CVE-2022-26377?
1 open source package ship an affected version, including apache. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | All versions | 2.4.54 |
Products include Apache Http Server, Fedoraproject Fedora, Netapp Clustered Data Ontap.
How do I fix CVE-2022-26377?
Upgrade apache to 2.4.54 or later.
Is CVE-2022-26377 being exploited?
There is no known exploitation of CVE-2022-26377 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2022-26377, BIT-apache-2022-26377, CLEANSTART-2026-IE55797, DEBIAN-CVE-2022-26377, GHSA-gx9q-f765-xrgg.