CVE-2022-26377

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.(CVE-2022-26377)

The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.(CVE-2022-28614)

Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.(CVE-2022-28615)

In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.(CVE-2022-29404)

Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.(CVE-2022-30556)

Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.(CVE-2022-31813)

If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.(CVE-2022-30522)

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943)

• httpd: mod_lua: Use of uninitialized value of in r:parsebody (CVE-2022-22719)

• httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (CVE-2022-22721)

• httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-26377)

• httpd: mod_lua: DoS in r:parsebody (CVE-2022-29404)

• httpd: mod_sed: DoS vulnerability (CVE-2022-30522)

• httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism (CVE-2022-31813)

• httpd: Out-of-bounds read via ap_rwrite() (CVE-2022-28614)

• httpd: Out-of-bounds read in ap_strcmp_match() (CVE-2022-28615)

• httpd: mod_lua: Information disclosure with websockets (CVE-2022-30556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

The following packages have been upgraded to a later upstream version: httpd (2.4.53). (BZ#2079939)

Security Fix(es):

• httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943)

• httpd: mod_lua: Use of uninitialized value of in r:parsebody (CVE-2022-22719)

• httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (CVE-2022-22721)

• httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-26377)

• httpd: mod_lua: DoS in r:parsebody (CVE-2022-29404)

• httpd: mod_sed: DoS vulnerability (CVE-2022-30522)

• httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism (CVE-2022-31813)

• httpd: Out-of-bounds read via ap_rwrite() (CVE-2022-28614)

• httpd: Out-of-bounds read in ap_strcmp_match() (CVE-2022-28615)

• httpd: mod_lua: Information disclosure with websockets (CVE-2022-30556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943)
• httpd: mod_lua: Use of uninitialized value of in r:parsebody (CVE-2022-22719)
• httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (CVE-2022-22721)
• httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-26377)
• httpd: mod_lua: DoS in r:parsebody (CVE-2022-29404)
• httpd: mod_sed: DoS vulnerability (CVE-2022-30522)
• httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism (CVE-2022-31813)
• httpd: Out-of-bounds read via ap_rwrite() (CVE-2022-28614)
• httpd: Out-of-bounds read in ap_strcmp_match() (CVE-2022-28615)
• httpd: mod_lua: Information disclosure with websockets (CVE-2022-30556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

The following packages have been upgraded to a later upstream version: httpd (2.4.53). (BZ#2079939)

Security Fix(es):

• httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943)
• httpd: mod_lua: Use of uninitialized value of in r:parsebody (CVE-2022-22719)
• httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (CVE-2022-22721)
• httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-26377)
• httpd: mod_lua: DoS in r:parsebody (CVE-2022-29404)
• httpd: mod_sed: DoS vulnerability (CVE-2022-30522)
• httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism (CVE-2022-31813)
• httpd: Out-of-bounds read via ap_rwrite() (CVE-2022-28614)
• httpd: Out-of-bounds read in ap_strcmp_match() (CVE-2022-28615)
• httpd: mod_lua: Information disclosure with websockets (CVE-2022-30556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.

• CVE-2022-30522: mod_sed: limit memory usage
• CVE-2022-26377: mod_proxy_ajp: fix HTTP request smuggling
• CVE-2022-28615: fix possible out-of-bounds read in ap_strcmp_match()
• CVE-2022-30556: mod_lua: fix r:wsread() to not return length that point past the end of the storage allocated for the buffer
• CVE-2022-31813: mod_proxy: preserve original request headers so an upstream knows what the original request hostname was, and so send X-Forwarded-* headers correctly

• CVE-2022-30522: mod_sed: limit memory usage
• CVE-2022-26377: mod_proxy_ajp: fix HTTP request smuggling
• CVE-2022-28615: fix possible out-of-bounds read in ap_strcmp_match()
• CVE-2022-30556: mod_lua: fix r:wsread() to not return length that point past the end of the storage allocated for the buffer
• CVE-2022-31813: mod_proxy: preserve original request headers so an upstream knows what the original request hostname was, and so send X-Forwarded-* headers correctly

• CVE-2022-26377: mod_proxy_ajp: fix HTTP request smuggling
• CVE-2022-28615: fix possible out-of-bounds read in ap_strcmp_match()
• CVE-2022-31813: mod_proxy: preserve original request headers so an upstream knows what the original request hostname was, and so send X-Forwarded-* headers correctly

• SECURITY UPDATE: mod_sed may make excessively large memory allocations and trigger an abort
  • debian/patches/CVE-2022-30522.patch: limit mod_sed memory usage
  • CVE-2022-30522
• SECURITY UPDATE: HTTP request smuggling in mod_proxy_ajp
  • debian/patches/CVE-2022-26377.patch: parse request headers in the way so Transfer-Encoding has precedence over Content-Length
  • CVE-2022-26377
• SECURITY UPDATE: possible out-of-bounds read in ap_strcmp_match() with an extremely large input buffer
  • debian/patches/CVE-2022-28615.patch: use apr_size_t (e.g. long) for array indexing
  • CVE-2022-28615
• SECURITY UPDATE: mod_lua r:wsread() may return length that points past the end of the storage allocated for the buffer
  • debian/patches/CVE-2022-30556.patch: consistently use lua_websocket_readbytes() and check the return value
  • CVE-2022-30556
• SECURITY UPDATE: mod_proxy may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism
  • debian/patches/CVE-2022-31813.patch: preserve original request headers so an upstream knows what the original request hostname was
  • CVE-2022-31813

• CVE-2022-26377: mod_proxy_ajp: fix HTTP request smuggling
• CVE-2022-28615: fix possible out-of-bounds read in ap_strcmp_match()
• CVE-2022-31813: mod_proxy: preserve original request headers so an upstream knows what the original request hostname was, and so send X-Forwarded-* headers correctly

• CVE-2021-26690: Fix NULL pointer dereference in mod_session
• CVE-2022-22719: Fix possible process crash due to unnoticed failures in mod_lua
• CVE-2022-29404: Fix possible DoS due to no default limit on possible input size in mod_lua
• CVE-2022-26377: Fix possible HTTP request smuggling in mod_proxy_ajp

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. (CVE-2022-26377) Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. (CVE-2022-28615) In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. (CVE-2022-29404) Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. (CVE-2022-30556) Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. (CVE-2022-31813)

These are all security issues fixed in the apache2-2.4.54-1.1 package on the GA media of openSUSE Tumbleweed.

This update for apache2 fixes the following issues:

• CVE-2022-26377: Fixed possible request smuggling in mod_proxy_ajp (bsc#1200338)
• CVE-2022-28614: Fixed read beyond bounds via ap_rwrite() (bsc#1200340)
• CVE-2022-28615: Fixed read beyond bounds in ap_strcmp_match() (bsc#1200341)
• CVE-2022-29404: Fixed denial of service in mod_lua r:parsebody (bsc#1200345)
• CVE-2022-30556: Fixed information disclosure in mod_lua with websockets (bsc#1200350)
• CVE-2022-30522: Fixed mod_sed denial of service (bsc#1200352)
• CVE-2022-31813: Fixed mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism (bsc#1200348)

This update for apache2 fixes the following issues:

• CVE-2022-26377: Fixed possible request smuggling in mod_proxy_ajp (bsc#1200338)
• CVE-2022-28614: Fixed read beyond bounds via ap_rwrite() (bsc#1200340)
• CVE-2022-28615: Fixed read beyond bounds in ap_strcmp_match() (bsc#1200341)
• CVE-2022-29404: Fixed denial of service in mod_lua r:parsebody (bsc#1200345)
• CVE-2022-30556: Fixed information disclosure in mod_lua with websockets (bsc#1200350)
• CVE-2022-30522: Fixed mod_sed denial of service (bsc#1200352)
• CVE-2022-31813: Fixed mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism (bsc#1200348)

This update for apache2 fixes the following issues:

• CVE-2022-26377: Fixed possible request smuggling in mod_proxy_ajp (bsc#1200338)
• CVE-2022-28614: Fixed read beyond bounds via ap_rwrite() (bsc#1200340)
• CVE-2022-28615: Fixed read beyond bounds in ap_strcmp_match() (bsc#1200341)
• CVE-2022-29404: Fixed denial of service in mod_lua r:parsebody (bsc#1200345)
• CVE-2022-30556: Fixed information disclosure in mod_lua with websockets (bsc#1200350)
• CVE-2022-30522: Fixed mod_sed denial of service (bsc#1200352)
• CVE-2022-31813: Fixed mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism (bsc#1200348)

This update for apache2 fixes the following issues:

• CVE-2022-26377: Fixed possible request smuggling in mod_proxy_ajp (bsc#1200338)
• CVE-2022-28614: Fixed read beyond bounds via ap_rwrite() (bsc#1200340)
• CVE-2022-28615: Fixed read beyond bounds in ap_strcmp_match() (bsc#1200341)
• CVE-2022-29404: Fixed denial of service in mod_lua r:parsebody (bsc#1200345)
• CVE-2022-30556: Fixed information disclosure in mod_lua with websockets (bsc#1200350)
• CVE-2022-30522: Fixed mod_sed denial of service (bsc#1200352)
• CVE-2022-31813: Fixed mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism (bsc#1200348)

This update for apache2 fixes the following issues:

• CVE-2022-26377: Fixed possible request smuggling in mod_proxy_ajp (bsc#1200338)
• CVE-2022-28614: Fixed read beyond bounds via ap_rwrite() (bsc#1200340)
• CVE-2022-28615: Fixed read beyond bounds in ap_strcmp_match() (bsc#1200341)
• CVE-2022-29404: Fixed denial of service in mod_lua r:parsebody (bsc#1200345)
• CVE-2022-30556: Fixed information disclosure in mod_lua with websockets (bsc#1200350)
• CVE-2022-30522: Fixed mod_sed denial of service (bsc#1200352)
• CVE-2022-31813: Fixed mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism (bsc#1200348)

This update for apache2 fixes the following issues

• CVE-2026-23918: http2: double free and possible RCE on early reset (bsc#1263957).
• CVE-2026-24072: mod_rewrite elevation of privileges via ap_expr (bsc#1263935).
• CVE-2026-28780: heap buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (bsc#1264163).
• CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
• CVE-2026-29168: allocation of resources without limits in mod_md via OCSP response (bsc#1264150).
• CVE-2026-29169: NULL pointer dereference in mod_dav_lock allows server crash via malicious requests (bsc#1263956).
• CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
• CVE-2026-33006: mod_auth_digest timing attack allows bypass of Digest authentication (bsc#1263955).
• CVE-2026-33007: NULL pointer dereference in mod_authn_socache allows unauthenticated remote user to crash a child processes (bsc#1263954).
• CVE-2026-33523: HTTP response splitting forwarding malicious status line (bsc#1263953).
• CVE-2026-33857: off-by-one OOB reads in AJP getter functions (bsc#1263952).
• CVE-2026-34032: heap buffer overread in mod_proxy_ajp due to missing null-termination check (bsc#1263951).
• CVE-2026-34059: heap buffer overread and memory disclosure via ajp_parse_data() (bsc#1263950).
• CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
• CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
• CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
• CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
• CVE-2026-43951: out-of-bound read in merge_response_headers can cause crash (bsc#1267963).
• CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
• CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP send_request (bsc#1267969).
• CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of service (bsc#1267970).
• CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
• CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free (bsc#1267972).
• CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).

Non security issue:

• Update to 2.4.66 (jsc#PED-16334).

It was discovered that Apache HTTP Server mod_proxy_ajp incorrectly handled certain crafted request. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. (CVE-2022-26377)

It was discovered that Apache HTTP Server incorrectly handled certain request. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-28614)

It was discovered that Apache HTTP Server incorrectly handled certain request. An attacker could possibly use this issue to cause a crash or expose sensitive information. (CVE-2022-28615)

It was discovered that Apache HTTP Server incorrectly handled certain request. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-29404)

It was discovered that Apache HTTP Server incorrectly handled certain request. An attacker could possibly use this issue to cause a crash. (CVE-2022-30522)

It was discovered that Apache HTTP Server incorrectly handled certain request. An attacker could possibly use this issue to execute arbitrary code or cause a crash. (CVE-2022-30556)

It was discovered that Apache HTTP Server incorrectly handled certain request. An attacker could possibly use this issue to bypass IP based authentication. (CVE-2022-31813)

USN-5487-1 fixed several vulnerabilities in Apache HTTP Server. Unfortunately it caused regressions. USN-5487-2 reverted the patches that caused the regression in Ubuntu 14.04 ESM for further investigation. This update re-adds the security fixes for Ubuntu 14.04 ESM and fixes two different regressions: one affecting mod_proxy only in Ubuntu 14.04 ESM and another in mod_sed affecting also Ubuntu 16.04 ESM and Ubuntu 18.04 LTS.

We apologize for the inconvenience.

Original advisory details:

It was discovered that Apache HTTP Server mod_proxy_ajp incorrectly handled certain crafted request. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. (CVE-2022-26377)

It was discovered that Apache HTTP Server incorrectly handled certain request. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-28614)

It was discovered that Apache HTTP Server incorrectly handled certain request. An attacker could possibly use this issue to cause a crash or expose sensitive information. (CVE-2022-28615)

It was discovered that Apache HTTP Server incorrectly handled certain request. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-29404)

It was discovered that Apache HTTP Server incorrectly handled certain request. An attacker could possibly use this issue to cause a crash. (CVE-2022-30522)

It was discovered that Apache HTTP Server incorrectly handled certain request. An attacker could possibly use this issue to execute arbitrary code or cause a crash. (CVE-2022-30556)

It was discovered that Apache HTTP Server incorrectly handled certain request. An attacker could possibly use this issue to bypass IP based authentication. (CVE-2022-31813)