Critical HTTP Request Smuggling Vulnerability in Apache HTTP Server (CVE-2022-36760)

apache2 Updated 02 Oct 2025

Summary

17/01/2023

Disclosed on

N/A

Severity

No i

Fix available

Critical

Severity

9.0

CVSS Score

UBUNTU-CVE-2022-36760: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. Affects apache2 versions 2.4.6-2ubuntu2 – 2.4.7-1ubuntu4.9. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache HTTP Server is a widely-used open-source web server software that enables the hosting of websites and applications. It is known for its flexibility, security features, and extensive module support. However, it is susceptible to various vulnerabilities, including CVE-2022-36760, which affects its mod_proxy_ajp module, allowing attackers to exploit the server's request handling mechanisms.

Vulnerability Detail

The vulnerability identified as CVE-2022-36760 is an 'Inconsistent Interpretation of HTTP Requests' issue, commonly referred to as HTTP Request Smuggling. This flaw allows an attacker to manipulate the way requests are processed by the Apache HTTP Server, specifically when forwarding requests to the AJP (Apache JServ Protocol) server. By exploiting this vulnerability, an attacker could smuggle malicious requests, potentially leading to unauthorized access, data leakage, or further attacks on the backend server. The vulnerability affects Apache HTTP Server versions 2.4.54 and prior, with a CVSS score of 9.0 indicating its critical nature.

How To Fix

No fixed version is published for this vulnerability.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

As a temporary workaround, consider disabling the mod_proxy_ajp module if it is not required for your application. This can be done by running the command: 'sudo a2dismod proxy_ajp' followed by

sudo systemctl restart apache2' to apply the changes.

Conclusion

CVE-2022-36760 is a critical vulnerability in the Apache HTTP Server that poses significant risks if left unaddressed. It is crucial for users to update their installations to the latest patched version to ensure the security of their web applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.

See every vulnerability recorded for apache2 →