Read the docs
TI-2022-09750 Aliases CVE-2022-26377GHSA-gx9q-f765-xrgg

mod_proxy_ajp: Possible request smuggling

Priority MEDIUM 52CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 7 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.

Why it matters now

EPSS 0.21079 97th percentileScored 2026-11-07
Fix Partial Red Hat: 5 advisoriesRed Hat: 7 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache HTTP ServerApache HTTP Server 2.4 – 2.4.53—No fix listedCNA
  • Apache HTTP Server VendorApache Affected Apache HTTP Server 2.4 – 2.4.53 Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*2.4.0 to before 2.4.54VulnerableApache
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions 2.4.0 to before 2.4.54 Vulnerable ·Apache
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
  • cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

Red Hat 5 advisories

  • RHSA-2022:8841 Released 2022-12-08 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 security update
    • Red Hat JBoss Core Services
  • RHSA-2022:8840 Released 2022-12-08 · Red Hat rating Moderate
    Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 security update
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl-7.86.0-2.el7jbcs, jbcs-httpd24-httpd-2.4.51-37.el7jbcs, jbcs-httpd24-httpd-devel-2.4.51-37.el7jbcs +15
    • Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl-7.86.0-2.el8jbcs, jbcs-httpd24-httpd-2.4.51-37.el8jbcs, jbcs-httpd24-httpd-devel-2.4.51-37.el8jbcs +15
  • RHSA-2022:8067 Released 2022-11-15 · Red Hat rating Moderate
    httpd security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) httpd-2.4.53-7.el9, httpd-core-2.4.53-7.el9, httpd-devel-2.4.53-7.el9 +8
Show 2 more Red Hat advisories
  • RHSA-2022:7647 Released 2022-11-08 · Red Hat rating Moderate
    httpd:2.4 security update
    • Red Hat Enterprise Linux AppStream (v. 8) httpd-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64::httpd:2.4, httpd-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le::httpd:2.4, httpd-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x::httpd:2.4 +38
  • RHSA-2022:6753 Released 2022-09-29 · Red Hat rating Moderate
    httpd24-httpd security and bug fix update
    • Red Hat Software Collections for RHEL Workstation(v. 7) httpd24-httpd-2.4.34-23.el7.5, httpd24-httpd-devel-2.4.34-23.el7.5, httpd24-httpd-manual-2.4.34-23.el7.5 +5
    • Red Hat Software Collections for RHEL(v. 7) httpd24-httpd-2.4.34-23.el7.5, httpd24-httpd-devel-2.4.34-23.el7.5, httpd24-httpd-manual-2.4.34-23.el7.5 +5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache HTTP Server — FEDORA-2022-b54a8dee29

    7 records Highest priority Priority HIGH 1 HIGH, 5 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2022-12679 mod_sed denial of servicePriority HIGH 76
    • TI-2022-11260 Read beyond bounds in ap_strcmp_match()Priority MEDIUM 55
    • TI-2022-13703 mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismPriority MEDIUM 48
    Show all 7 records → Advisory →
  • Advisory ·

    Apache HTTP Server — FEDORA-2022-e620fb15d5

    7 records Highest priority Priority HIGH 1 HIGH, 5 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2022-12679 mod_sed denial of servicePriority HIGH 76
    • TI-2022-11260 Read beyond bounds in ap_strcmp_match()Priority MEDIUM 55
    • TI-2022-13703 mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismPriority MEDIUM 48
    Show all 7 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Web Server 3AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:7647
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:8067
Red Hat JBoss Core ServicesFixed RHSA-2022:8841
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2022:8840
Red Hat JBoss Core Services on RHEL 8Fixed RHSA-2022:8840
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2022:6753
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2022:6753
Not affected: 2 products
  • Red Hat JBoss Core Services on RHEL 7 Server
  • Red Hat JBoss Core Services on RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-26377
  2. 2026-10-03 Alias added: GHSA-gx9q-f765-xrgg
  3. 2026-10-09 Fix available: RHSA-2022:8841 · Red Hat
  4. 2026-10-09 Fix available: Red Hat JBoss Core Services · Red Hat

References

Advisory 6

  • TI-2021-18535 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-18417 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-25716 Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. KEVCVSS 3.1CRITICAL 9.1
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
  • TI-2019-00184 Use after free in Apache HTTP Server KEVCVSS 3.1HIGH 7.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
See all 349 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences