CVE-2022-26377

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-444

Affected software

No affected versions have been published.

Timeline

Published: Jun 9, 2022
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-26386.5The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be t CVE-2022-263807.5A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X CVE-2022-263818.8An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash. This vu CVE-2022-263824.3While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts. Side-channel at CVE-2022-263834.3When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This vulnerability affect CVE-2022-263849.6If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they wer CVE-2022-263856.5In unusual circumstances, an individual thread may outlive the thread's manager during shutdown. This could have led to a use-after-free cau CVE-2022-263866.5Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior w CVE-2022-263877.5When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the under CVE-2022-263886.4A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph: Versions CVE-2022-263897.7An improper access control vulnerability may allow privilege escalation.This issue affects: * ELI 380 Resting Electrocardiograph: Vers CVE-2022-26397.8An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserv