Read the docs
TI-2022-02080 Aliases CVE-2022-2255GHSA-7527-8855-9cf8

Insufficient verification of data authenticity in mod_wsgi

Priority LOW 35CWE-348Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-345.

Summary

A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing.

Why it matters now

EPSS 0.00939 61st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial mod-wsgi (PyPI): 4.9.3Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—mod_wsgimod_wsgi versions prior to 4.9.3—No fix listedCNA
—mod-wsgi (PyPI)before 4.9.34.9.3Patch availableGHSA-7527-8855-9cf8
  • mod_wsgi Vendor— Affected mod_wsgi versions prior to 4.9.3 Fixed in — No fix listed CNA
  • mod-wsgi (PyPI) Vendor— Affected before 4.9.3 Fixed in 4.9.3 Patch available GHSA-7527-8855-9cf8

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:modwsgi:mod_wsgi:*:*:*:*:*:*:*:*before 4.9.3Vulnerablemod_wsgi
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:modwsgi:mod_wsgi:*:*:*:*:*:*:*:* Versions before 4.9.3 Vulnerable ·mod_wsgi
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-7527-8855-9cf8 mod-wsgi (PyPI) Fixed in 4.9.3 Advisory →

Red Hat 1 advisory

  • RHSA-2025:4791 Released 2025-05-12 · Red Hat rating Moderate
    python39:3.9 security update
    • Red Hat Enterprise Linux AppStream (v. 8) PyYAML-5.4.1-1.module+el8.9.0+19644+d68f775d.src::python39:3.9, mod_wsgi-4.7.1-7.module+el8.10.0+23075+0aa18782.1.src::python39:3.9, numpy-1.19.4-3.module+el8.9.0+19644+d68f775d.src::python39:3.9 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:4791
Not affected: 2 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2255
  2. 2026-10-03 Alias added: GHSA-7527-8855-9cf8

References

Exploit 2

Advisory 3

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences