The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
CVSS Details
- CVSS 3.1 Base Score: 4.7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Apr 12, 2012 | Jul 5, 2005 |
| Apple Osx Apache2 | — | Apply OS X security update 2005-009 | Dec 16, 2011 | Jul 5, 2005 |
| Debian | — | Upgrade apache2 | Jul 30, 2024 | Jul 5, 2005 |
| Freebsd | — | Upgrade apache+mod_ssl+mod_deflate+ipv6Upgrade apache+mod_ssl+mod_accel+ipv6Upgrade apache+mod_sslUpgrade apache+mod_ssl+mod_snmp+mod_accel+ipv6Upgrade apache+mod_ssl+mod_snmp+mod_deflateUpgrade apache+mod_ssl+mod_accel+mod_deflate+ipv6Upgrade apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6Upgrade apache+mod_ssl+mod_accel+mod_deflateUpgrade apache+mod_ssl+ipv6Upgrade apacheUpgrade apache+ipv6Upgrade apache+mod_ssl+mod_deflateUpgrade apache+mod_perlUpgrade apache+mod_ssl+mod_snmpUpgrade apache+mod_ssl+mod_accelUpgrade apache+mod_ssl+mod_snmp+mod_accelUpgrade ru-apache+mod_sslUpgrade apache_fpUpgrade apache+mod_ssl+mod_snmp+mod_deflate+ipv6Upgrade apache+sslUpgrade ru-apache | Dec 10, 2025 | Jul 26, 2005 |
| Hpux | — | Apply patch PHSS_34119 from HPApply patch PHSS_34123 from HPApply patch PHSS_34203 from HPApply the remediation from HP for CVE-2005-2088Apply patch PHSS_34171 from HPApply patch PHSS_34120 from HPApply patch PHSS_34163 from HPApply patch PHSS_34204 from HPApply patch PHSS_34169 from HPApply patch PHSS_34121 from HPApply patch PHSS_34170 from HP | Aug 11, 2017 | Jul 5, 2005 |
| Suse | — | Upgrade apache2-example-pagesUpgrade apache2-develUpgrade apache2Upgrade libapr0Upgrade apache2-preforkUpgrade apacheUpgrade apache2-docUpgrade mod_sslUpgrade apache2-worker | Feb 17, 2015 | Jul 5, 2005 |
| Ubuntu | — | Upgrade apache2-mpm-preforkUpgrade apache2-mpm-worker | Nov 8, 2024 | Jul 5, 2005 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub