CVE-2022-37436

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-37436
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-37436.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-37436
Aliases
Downstream
Related
Published
2023-01-17T19:12:59.968Z
Modified
2026-05-18T05:55:47.386376821Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting
Details

Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37436.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "2.4.55"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-113"
    ],
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/httpd

Affected ranges

Type
GIT
Repo
https://github.com/apache/httpd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8201e867f1d4cdf61840625c6c4be901e3f1b6ba
Database specific 
{
    "source": "CPE_FIELD",
    "cpe": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.4.55"
        }
    ]
}

Affected versions

2.*
2.4.55-rc1-candidate

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-37436.json"