SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2022-22720

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

CRITICAL 9.8EPSS 28.2%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 28.2%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.

Description

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

CVSS 3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
28.19% probability · 98th percentile
CISA KEV
Not listed
Weakness
CWE-444
Affected
apache/http server · fedoraproject/fedora · debian/debian linux · oracle/enterprise manager ops center · oracle/http server · oracle/zfs storage appliance kit · apple/mac os x · apple/macos
Source
security@apache.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.