CVE-2022-37436

Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.

References

Affected packages

Git / github.com/apache/httpd

Affected ranges

Type

GIT

Repo

https://github.com/apache/httpd

Events

Introduced

Fixed

8201e867f1d4cdf61840625c6c4be901e3f1b6ba

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.4.55"
        }
    ]
}

Affected versions

2.*

2.4.55-rc1-candidate

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37436.json"