Description
The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | httpd +3 | 2.0.52-12.1.ent | RHSA-2005:582 |
| RHEL 4 | mod_ssl | 1:2.0.52-12.1.ent | RHSA-2005:582 |
| RHEL 3 | httpd +1 | 2.0.46-46.2.ent | RHSA-2005:582 |
| RHEL 3 | mod_ssl | 1:2.0.46-46.2.ent | RHSA-2005:582 |
Advisories 3
- RHSA-2005:582 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-803-1 apache - programming error Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-805-1 apache2 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 17319 third-party-advisory
- SUSE-SR:2005:018 vendor-advisory
- RHSA-2005:582 vendor-advisory
- SUSE-SA:2005:046 vendor-advisory
- USN-160-2 vendor-advisory
- ADV-2005-2140 vdb-entry
- 17813 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm
- ADV-2005-2659 vdb-entry
- TSLSA-2005-0059 vendor-advisory
- PK13959 vendor-advisory
- SSA:2005-310-04 vendor-advisory
- oval:org.mitre.oval:def:840 vdb-entry signature
- ADV-2006-1018 vdb-entry
- SSRT051251 vendor-advisory
- MDKSA-2005:130 vendor-advisory
- http://www.apache.org/dist/httpd/CHANGES_1.3
- 19185 third-party-advisory
- http://www.apache.org/dist/httpd/CHANGES_2.0
- 14530 third-party-advisory
- ADV-2006-4680 vdb-entry
- 604 third-party-advisory
- 17487 third-party-advisory
- 19317 third-party-advisory
- APPLE-SA-2005-11-29 vendor-advisory
- HPSBUX02101 vendor-advisory
- oval:org.mitre.oval:def:1629 vdb-entry signature
- 1014323 vdb-entry
- 19072 third-party-advisory
- oval:org.mitre.oval:def:1237 vdb-entry signature
- http://www.securiteam.com/securityreviews/5GP0220G0U.html
- http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf
- PK16139 vendor-advisory
- DSA-805 vendor-advisory
- 19073 third-party-advisory
- [apache-httpd-announce] 20051014 Apache HTTP Server 2.0.55 Released mailing-list
- 15647 vdb-entry
- https://secure-support.novell.com/KanisaPlatform/Publishing/741/3222109_f.SAL_Public.html
- 14106 vdb-entry
- 20050606 A new whitepaper by Watchfire - HTTP Request Smuggling mailing-list
- DSA-803 vendor-advisory
- 23074 third-party-advisory
- 102197 vendor-advisory
- oval:org.mitre.oval:def:1526 vdb-entry signature
- 102198 vendor-advisory
- oval:org.mitre.oval:def:11452 vdb-entry signature
- ADV-2006-0789 vdb-entry
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [3/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [3/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [4/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list