The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Apr 12, 2012 | Jul 5, 2005 |
| Apple Osx Apache2 | — | Apply OS X security update 2005-009 | Dec 16, 2011 | Jul 5, 2005 |
| Debian | — | Upgrade apache2 | Jul 30, 2024 | Jul 5, 2005 |
| Freebsd | — | Upgrade apache+mod_ssl+mod_snmp+mod_accelUpgrade apache_fpUpgrade apache+sslUpgrade ru-apacheUpgrade ru-apache+mod_sslUpgrade apache+ipv6Upgrade apache+mod_ssl+mod_snmpUpgrade apacheUpgrade apache+mod_sslUpgrade apache+mod_ssl+mod_accel+mod_deflateUpgrade apache+mod_ssl+mod_deflateUpgrade apache+mod_ssl+ipv6Upgrade apache+mod_ssl+mod_accel+mod_deflate+ipv6Upgrade apache+mod_ssl+mod_deflate+ipv6Upgrade apache+mod_ssl+mod_snmp+mod_deflateUpgrade apache+mod_ssl+mod_accelUpgrade apache+mod_ssl+mod_accel+ipv6Upgrade apache+mod_ssl+mod_snmp+mod_accel+ipv6Upgrade apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6Upgrade apache+mod_perlUpgrade apache+mod_ssl+mod_snmp+mod_deflate+ipv6 | Dec 10, 2025 | Jul 26, 2005 |
| Hpux | — | Apply patch PHSS_34203 from HPApply patch PHSS_34123 from HPApply patch PHSS_34170 from HPApply patch PHSS_34204 from HPApply patch PHSS_34163 from HPApply patch PHSS_34169 from HPApply patch PHSS_34121 from HPApply patch PHSS_34171 from HPApply patch PHSS_34120 from HPApply the remediation from HP for CVE-2005-2088Apply patch PHSS_34119 from HP | Aug 11, 2017 | Jul 5, 2005 |
| Suse | — | Upgrade apache2Upgrade apache2-develUpgrade apache2-example-pagesUpgrade apache2-preforkUpgrade libapr0Upgrade apache2-workerUpgrade mod_sslUpgrade apache2-docUpgrade apache | Feb 17, 2015 | Jul 5, 2005 |
| Ubuntu | — | Upgrade apache2-mpm-workerUpgrade apache2-mpm-prefork | Nov 8, 2024 | Jul 5, 2005 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub