CVE-2022-37436: Http Server Vulnerability (CVSS 5.3)

CVE-2022-37436 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client. EPSS estimates a 57.94% chance of exploitation in the next 30 days.

Description

Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.

Metrics

CVSS 3.15.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Probability 57.94%

99.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

• CWE-113
• CWE-436
• CWE-113

Affected Software

References

• Release Notes, Vendor Advisory
• GLSA 202309-01

Timeline

Published Jan 17, 2023

Last Modified Jun 17, 2026

Status Modified

Frequently Asked Questions

What is CVE-2022-37436?

How severe is CVE-2022-37436?

CVE-2022-37436 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 57.94% probability of exploitation in the next 30 days.

How do I fix CVE-2022-37436?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.