VULNERABILITY INTELLIGENCE

CVE-2022-37436

CVSS score5.3 MEDIUM
EPSS probability55.91%
CISA KEVNot currently listed
Published2023-01-17
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.

Weakness classification

  • security@apache.org: CWE-113
  • nvd@nist.gov: CWE-436
  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-113

Primary references