Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-37436

Good to know:

icon

Date: January 17, 2023

Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.

Language: C

Severity Score

Related Resources (6)

https://nvd.nist.gov/vuln/detail/CVE-2022-37436
https://security-tracker.debian.org/tracker/CVE-2022-37436
https://access.redhat.com/security/cve/CVE-2022-37436
https://httpd.apache.org/security/vulnerabilities_24.html
https://security.gentoo.org/glsa/202309-01
https://www.mend.io/vulnerability-database/CVE-2022-37436

Severity Score

Weakness Type (CWE)

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

CWE-113

Interpretation Conflict

CWE-436

Top Fix

icon

Upgrade Version

Upgrade to version 2.4.55

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us