The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
CVSS Details
- CVSS 3.1 Base Score: 4.7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Apr 12, 2012 | Jul 5, 2005 |
| Apple Osx Apache2 | — | Apply OS X security update 2005-009 | Dec 16, 2011 | Jul 5, 2005 |
| Debian | — | Upgrade apache2 | Jul 30, 2024 | Jul 5, 2005 |
| Freebsd | — | Upgrade apache+mod_ssl+mod_snmp+mod_deflateUpgrade apache+mod_perlUpgrade apache+mod_ssl+ipv6Upgrade apache+mod_ssl+mod_deflateUpgrade apache+mod_ssl+mod_accel+mod_deflate+ipv6Upgrade apache+mod_ssl+mod_deflate+ipv6Upgrade apache+mod_ssl+mod_snmpUpgrade apache+ipv6Upgrade apache+mod_ssl+mod_snmp+mod_accel+ipv6Upgrade apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6Upgrade apacheUpgrade apache+mod_ssl+mod_accelUpgrade apache+mod_ssl+mod_accel+mod_deflateUpgrade apache+mod_ssl+mod_accel+ipv6Upgrade apache+mod_sslUpgrade ru-apacheUpgrade apache+sslUpgrade apache_fpUpgrade apache+mod_ssl+mod_snmp+mod_accelUpgrade ru-apache+mod_sslUpgrade apache+mod_ssl+mod_snmp+mod_deflate+ipv6 | Dec 10, 2025 | Jul 26, 2005 |
| Hpux | — | Apply patch PHSS_34203 from HPApply patch PHSS_34123 from HPApply patch PHSS_34119 from HPApply patch PHSS_34120 from HPApply patch PHSS_34171 from HPApply the remediation from HP for CVE-2005-2088Apply patch PHSS_34163 from HPApply patch PHSS_34121 from HPApply patch PHSS_34169 from HPApply patch PHSS_34204 from HPApply patch PHSS_34170 from HP | Aug 11, 2017 | Jul 5, 2005 |
| Suse | — | Upgrade apache2-workerUpgrade apacheUpgrade mod_sslUpgrade apache2-docUpgrade apache2-develUpgrade libapr0Upgrade apache2Upgrade apache2-preforkUpgrade apache2-example-pages | Feb 17, 2015 | Jul 5, 2005 |
| Ubuntu | — | Upgrade apache2-mpm-preforkUpgrade apache2-mpm-worker | Nov 8, 2024 | Jul 5, 2005 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub