{"id":"CVE-2022-37436","published":"2023-01-17T19:12:59Z","modified":"2025-04-04T18:06:37Z","title":"Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting","vendor":"Apache Software Foundation","product":"Apache HTTP Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache HTTP Server","versions":["< 2.4.55"]}],"description":{"text":"Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Apache HTTP Server (prior to 2.4.55) contains an HTTP response-splitting flaw in its handling of response headers from backends, where early truncation causes some headers to be emitted inside the response body. An attacker who controls a malicious backend can exploit this without authentication or user interaction over the network, and while the impact is limited to integrity, any later headers that carry security meaning will be ignored by the client.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:41Z"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.55911,"percentile":0.99045,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-113","name":"Improper Neutralization of CRLF Sequences in HTTP Headers"}],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["vendor-advisory"]},{"url":"https://security.gentoo.org/glsa/202309-01","tags":[]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Exploited via malicious backend affecting public-facing web server responses","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"a malicious backend can cause the response headers to be truncated early","start":36,"end":108}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Response manipulation injects content altering client-side interpretation","mappingType":"primary_impact","evidence":[{"from":"description","quote":"some headers being incorporated into the response body","start":123,"end":177}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-b804e28bf5894dd4955f","title":"Whitepaper Name Goes","publisher":"trustwave.com","url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/Trustwave_SpiderLabs_2023_Hospitality_Sector_Threat_Landscape.pdf","date":null,"mentions":[{"quote":"▪ Mod_proxy module of httpd (CVE-2022-37436)","start":45647,"end":45691}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-40063","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-40063","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1557"],"provenance":"ai"}],"timeline":[{"date":"2023-01-17","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-37436","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":27.4,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.81,"detail":"percentile 0.9905"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.71,"detail":"base score 5.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}