CVE-2022-25763

Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

• CWE-444
• CWE-444

• https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21Mailing List, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJ67IWD5PRJUOIYIDJRUG3UMS2UF4X4J/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCSBQBYPOZSWS5LCOAQ6LJLRLXFIAW5A/Mailing List, Third Party Advisory
• https://www.debian.org/security/2022/dsa-5206Third Party Advisory
• https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21Mailing List, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJ67IWD5PRJUOIYIDJRUG3UMS2UF4X4J/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCSBQBYPOZSWS5LCOAQ6LJLRLXFIAW5A/Mailing List, Third Party Advisory
• https://www.debian.org/security/2022/dsa-5206Third Party Advisory

Published

Aug 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25758All versions of package scss-tokenizer are vulnerable to Reg…7.5
• CVE-2022-25759The package convert-svg-core before 0.6.2 are vulnerable to …9.8
• CVE-2022-2576In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.…7.5
• CVE-2022-25760All versions of package accesslog are vulnerable to Arbitrar…9.8
• CVE-2022-25761The package open62541/open62541 before 1.2.5, from 1.3-rc1 a…7.5
• CVE-2022-25762If a web application sends a WebSocket message concurrently …8.6
• CVE-2022-25765The package pdfkit from 0.0.0 are vulnerable to Command Inje…9.8
• CVE-2022-25766The package ungit before 1.5.20 are vulnerable to Remote Cod…8.8
• CVE-2022-25767All versions of package com.bstek.ureport:ureport2-console a…9.8
• CVE-2022-25768The logic in place to facilitate the update process via the …6.5
• CVE-2022-25769ImpactThe default .htaccess file has some restrictions in th…9.1
• CVE-2022-2577A vulnerability classified as critical was found in SourceCo…8.8