The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does…
Priority MEDIUM 61CWE-17Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Partial Red Hat: 29 fixed, 5 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.
Summary
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.
Why it matters now
EPSS 0.74387 99th percentileScored 2026-11-07
Fix Partial Red Hat: 11 advisoriesRed Hat: 29 fixed, 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
Red Hat 11 advisories
- RHSA-2016:2055 Released 2016-10-12 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 6.4.10 natives update on RHEL 6
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server hornetq-native-2.3.25-4.SP11_redhat_1.ep6.el6, hornetq-native-2.3.25-4.SP11_redhat_1.ep6.el6.i386, httpd-2.2.26-54.ep6.el6 +29
- RHSA-2016:2054 Released 2016-10-12 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 6.4.10 natives update on RHEL 7
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server hornetq-native-2.3.25-4.SP11_redhat_1.ep6.el7, httpd22-2.2.26-56.ep6.el7, httpd22-devel-2.2.26-56.ep6.el7 +17
- RHSA-2016:2056 Released 2016-10-12 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.10 update
- Red Hat JBoss Enterprise Application Platform 6.4
Show 8 more Red Hat advisories
- RHSA-2016:0061 Released 2016-01-21 · Red Hat rating Moderatehttpd and httpd22 security update
- Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server httpd-2.2.26-41.ep6.el5, httpd-2.2.26-41.ep6.el5.i386, httpd-devel-2.2.26-41.ep6.el5 +9
- Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server httpd-2.2.26-41.ep6.el6, httpd-2.2.26-41.ep6.el6.i386, httpd-devel-2.2.26-41.ep6.el6 +9
- Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server httpd22-2.2.26-42.ep6.el7, httpd22-devel-2.2.26-42.ep6.el7, httpd22-manual-2.2.26-42.ep6.el7 +3
- RHSA-2016:0062 Released 2016-01-21 · Red Hat rating ModerateRed Hat JBoss Web Server 2.1.0 security update
- Red Hat JBoss Web Server 2.1
- RHSA-2015:2659 Released 2015-12-16 · Red Hat rating ModerateRed Hat JBoss Web Server 3.0.2 security update
- Red Hat JBoss Web Server 3.0 for RHEL 6 apache-commons-collections-eap6-3.2.1-18.redhat_7.1.ep6.el6, apache-commons-collections-tomcat-eap6-3.2.1-18.redhat_7.1.ep6.el6, httpd24-2.4.6-59.ep7.el6 +30
- RHSA-2015:2660 Released 2015-12-16 · Red Hat rating ModerateRed Hat JBoss Web Server 3.0.2 security update
- Red Hat JBoss Web Server 3.0 for RHEL 7 apache-commons-collections-eap6-3.2.1-18.redhat_7.1.ep6.el7, apache-commons-collections-tomcat-eap6-3.2.1-18.redhat_7.1.ep6.el7, httpd24-2.4.6-59.ep7.el7 +30
- RHSA-2015:2661 Released 2015-12-16 · Red Hat rating ModerateRed Hat JBoss Web Server 3.0.2 security update
- Red Hat JBoss Web Server 3.0
- RHSA-2015:1667 Released 2015-08-24 · Red Hat rating Moderatehttpd security update
- Red Hat Enterprise Linux Client Optional (v. 7) httpd-2.4.6-31.el7_1.1, httpd-devel-2.4.6-31.el7_1.1, httpd-manual-2.4.6-31.el7_1.1 +5
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd-2.4.6-31.el7_1.1, httpd-devel-2.4.6-31.el7_1.1, httpd-manual-2.4.6-31.el7_1.1 +5
- Red Hat Enterprise Linux Server (v. 7) httpd-2.4.6-31.ael7b_1.1, httpd-2.4.6-31.el7_1.1, httpd-devel-2.4.6-31.ael7b_1.1 +7
- Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap-2.4.6-31.ael7b_1.1, mod_ldap-2.4.6-31.el7_1.1, mod_proxy_html-1:2.4.6-31.ael7b_1.1 +3
- Red Hat Enterprise Linux Workstation (v. 7) httpd-2.4.6-31.el7_1.1, httpd-devel-2.4.6-31.el7_1.1, httpd-manual-2.4.6-31.el7_1.1 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap-2.4.6-31.el7_1.1, mod_proxy_html-1:2.4.6-31.el7_1.1, mod_session-2.4.6-31.el7_1.1
- RHSA-2015:1666 Released 2015-08-24 · Red Hat rating Moderatehttpd24-httpd security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-httpd-2.4.12-4.el6.2, httpd24-httpd-devel-2.4.12-4.el6.2, httpd24-httpd-manual-2.4.12-4.el6.2 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-httpd-2.4.12-6.el7.1, httpd24-httpd-devel-2.4.12-6.el7.1, httpd24-httpd-manual-2.4.12-6.el7.1 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.5) httpd24-httpd-2.4.12-4.el6.2, httpd24-httpd-devel-2.4.12-4.el6.2, httpd24-httpd-manual-2.4.12-4.el6.2 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) httpd24-httpd-2.4.12-4.el6.2, httpd24-httpd-devel-2.4.12-4.el6.2, httpd24-httpd-manual-2.4.12-4.el6.2 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) httpd24-httpd-2.4.12-6.el7.1, httpd24-httpd-devel-2.4.12-6.el7.1, httpd24-httpd-manual-2.4.12-6.el7.1 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-httpd-2.4.12-4.el6.2, httpd24-httpd-devel-2.4.12-4.el6.2, httpd24-httpd-manual-2.4.12-4.el6.2 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-httpd-2.4.12-6.el7.1, httpd24-httpd-devel-2.4.12-6.el7.1, httpd24-httpd-manual-2.4.12-6.el7.1 +5
- RHSA-2015:1668 Released 2015-08-24 · Red Hat rating Moderatehttpd security update
- Red Hat Enterprise Linux Desktop (v. 6) httpd-2.2.15-47.el6_7, httpd-tools-2.2.15-47.el6_7
- Red Hat Enterprise Linux Desktop Optional (v. 6) httpd-devel-2.2.15-47.el6_7, httpd-manual-2.2.15-47.el6_7, mod_ssl-1:2.2.15-47.el6_7
- Red Hat Enterprise Linux HPC Node (v. 6) httpd-2.2.15-47.el6_7, httpd-tools-2.2.15-47.el6_7
- Red Hat Enterprise Linux HPC Node Optional (v. 6) httpd-devel-2.2.15-47.el6_7, httpd-manual-2.2.15-47.el6_7, mod_ssl-1:2.2.15-47.el6_7
- Red Hat Enterprise Linux Server (v. 6) httpd-2.2.15-47.el6_7, httpd-devel-2.2.15-47.el6_7, httpd-devel-2.2.15-47.el6_7.ppc +3
- Red Hat Enterprise Linux Workstation (v. 6) httpd-2.2.15-47.el6_7, httpd-devel-2.2.15-47.el6_7, httpd-manual-2.2.15-47.el6_7 +2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| CloudForms Management Engine 5 | Affected | No fix yet |
| Red Hat Directory Server 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 4 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Web Server 1 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2015:1667 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2015:1667 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2015:1668 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2015:1668 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2015:1668 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2015:1668 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2015:1668 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2015:1667 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2015:1667 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2015:1668 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2015:1667 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2015:1667 |
| Red Hat JBoss Enterprise Application Platform 6.4 | Fixed | RHSA-2016:2056 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server | Fixed | RHSA-2016:2055 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server | Fixed | RHSA-2016:2054 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server | Fixed | RHSA-2016:0061 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server | Fixed | RHSA-2016:0061 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server | Fixed | RHSA-2016:0061 |
| Red Hat JBoss Web Server 2.1 | Fixed | RHSA-2016:0062 |
| Red Hat JBoss Web Server 3.0 | Fixed | RHSA-2015:2661 |
| Red Hat JBoss Web Server 3.0 for RHEL 6 | Fixed | RHSA-2015:2659 |
| Red Hat JBoss Web Server 3.0 for RHEL 7 | Fixed | RHSA-2015:2660 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2015:1666 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2015:1666 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.5) | Fixed | RHSA-2015:1666 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) | Fixed | RHSA-2015:1666 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) | Fixed | RHSA-2015:1666 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2015:1666 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2015:1666 |
Timeline
- 2026-10-02 Threatist record created from CVE-2015-3183
- 2026-10-03 Alias added: GHSA-892q-vvcr-v6j5
References
Patch 2
Advisory 48
- HPSBUX03512
- RHSA-2016:2056
- openSUSE-SU-2015:1684
- http://httpd.apache.org/security/vulnerabilities_24.html
- RHSA-2016:0061
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
- GLSA-201610-02
- RHSA-2015:1667
- RHSA-2016:0062
- http://www.apache.org/dist/httpd/CHANGES_2.4
- RHSA-2015:1666
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246
- RHSA-2015:1668
- RHSA-2015:2661
- RHSA-2016:2055
- USN-2686-1
- APPLE-SA-2015-08-13-2
- DSA-3325
- RHSA-2015:2659
- https://github.com/apache/httpd/commit/e427c41257957b57036d5a549b260b6185d1dd73
- https://puppet.com/security/cve/CVE-2015-3183
- RHSA-2015:2660
- RHSA-2016:2054
- https://support.apple.com/kb/HT205031
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789
- APPLE-SA-2015-09-16-4
- https://support.apple.com/HT205219
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- https://github.com/apache/httpd/commit/a6027e56924bb6227c1fdbf6f91e7e2438338be6
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
- [httpd-cvs] 20210330 svn commit: r1073139 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1888194 [9/13] - /httpd/site/trunk/content/security/json/
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/
- [httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073149 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
More Apache Http Server vulnerabilities
- TI-2021-18535 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) KEVCVSS 3.1CRITICAL 9.8
- TI-2021-18417 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 KEVCVSS 3.1CRITICAL 9.8
- TI-2024-25716 Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. KEVCVSS 3.1CRITICAL 9.1
- TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
- TI-2019-00184 Use after free in Apache HTTP Server KEVCVSS 3.1HIGH 7.8
- TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2015-3183 · CVE Program
- CVE-2015-3183 · NVD
- FIRST EPSS
- GHSA-892q-vvcr-v6j5 · GitHub Advisory Database · CC BY 4.0
- CVE-2015-3183 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences