CVE-2022-26377

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.

• CWE-444
• CWE-444

• http://www.openwall.com/lists/oss-security/2022/06/08/2Mailing List, Third Party Advisory
• https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/Third Party Advisory
• https://security.gentoo.org/glsa/202208-20Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220624-0005/Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/06/08/2Mailing List, Third Party Advisory
• https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/Third Party Advisory
• https://security.gentoo.org/glsa/202208-20Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220624-0005/Third Party Advisory

Published

Jun 9, 2022

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26370On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versi…7.5
• CVE-2022-26372On F5 BIG-IP 15.1.x versions prior to 15.1.0.2, 14.1.x versi…7.5
• CVE-2022-26373Non-transparent sharing of return predictor targets between …5.5
• CVE-2022-26374Uncontrolled search path in the installation binaries for In…7.8
• CVE-2022-26375Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2022-26376A memory corruption vulnerability exists in the httpd unesca…9.8
• CVE-2022-2638The Export All URLs WordPress plugin before 4.4 does not val…6.5
• CVE-2022-26380A vulnerability has been identified in SCALANCE X302-7 EEC (…7.5
• CVE-2022-26381An attacker could have caused a use-after-free by forcing a …8.8
• CVE-2022-26382While the text displayed in Autofill tooltips cannot be dire…4.3
• CVE-2022-26383When resizing a popup after requesting fullscreen access, th…4.3
• CVE-2022-26384If an attacker could control the contents of an iframe sandb…9.6