Description

Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.

Remediation

References

CVE-2022-37436

Related Vulnerabilities

Ruby on Rails Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-0081)

Oracle HTTP Server Use of Insufficiently Random Values Vulnerability (CVE-2020-35163)

MySQL CVE-2015-2643 Vulnerability (CVE-2015-2643)

WordPress Plugin Disqus Comment System Multiple Cross-Site Request Forgery Vulnerabilities (2.77)

Sqlite Numeric Truncation Error Vulnerability (CVE-2025-6965)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-436 CVE-2022-37436