MediumFix available
apache2 — security advisory
Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.
- Products
- apache2
- Affected versions
- Not specified
- Fixed versions
- 2.4.55-r0
- CVEs
- CVE-2022-37436
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 14:18 UTC · Revision 1
Source evidence
Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.
osv:ALPINE-CVE-2022-37436
apache2
Fixed versions: 2.4.55-r0
apache2
Fixed versions: 2.4.55-r0
apache2
Fixed versions: 2.4.55-r0
apache2
Fixed versions: 2.4.55-r0
apache2
Fixed versions: 2.4.55-r0
apache2
Fixed versions: 2.4.55-r0
apache2
Fixed versions: 2.4.55-r0
apache2
Fixed versions: 2.4.55-r0
apache2
Fixed versions: 2.4.55-r0
apache2
Fixed versions: 2.4.55-r0
apache2
Fixed versions: 2.4.55-r0
Complete source record
{
"id": "a5195574eed544065441eba818369a36649bca1449e8f3cf4ee409a9b67ebe44",
"url": "https://osv.dev/vulnerability/ALPINE-CVE-2022-37436",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ALPINE-CVE-2022-37436",
"summary": "Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.",
"evidence": "osv:ALPINE-CVE-2022-37436",
"products": [
{
"name": {
"value": "apache2",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.55-r0",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "apache2",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.55-r0",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "apache2",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.55-r0",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "apache2",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.55-r0",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "apache2",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.55-r0",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "apache2",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.55-r0",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "apache2",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.55-r0",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "apache2",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.55-r0",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "apache2",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.55-r0",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "apache2",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.55-r0",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "apache2",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.55-r0",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "ALPINE-CVE-2022-37436",
"aliases": [
"ALPINE-CVE-2022-37436"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.55-r0"
}
]
}
],
"package": {
"name": "apache2",
"purl": "pkg:apk/alpine/apache2?arch=source",
"ecosystem": "Alpine:v3.14"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-37436.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.55-r0"
}
]
}
],
"package": {
"name": "apache2",
"purl": "pkg:apk/alpine/apache2?arch=source",
"ecosystem": "Alpine:v3.15"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-37436.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.55-r0"
}
]
}
],
"package": {
"name": "apache2",
"purl": "pkg:apk/alpine/apache2?arch=source",
"ecosystem": "Alpine:v3.16"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-37436.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.55-r0"
}
]
}
],
"package": {
"name": "apache2",
"purl": "pkg:apk/alpine/apache2?arch=source",
"ecosystem": "Alpine:v3.17"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-37436.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.55-r0"
}
]
}
],
"package": {
"name": "apache2",
"purl": "pkg:apk/alpine/apache2?arch=source",
"ecosystem": "Alpine:v3.18"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-37436.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.55-r0"
}
]
}
],
"package": {
"name": "apache2",
"purl": "pkg:apk/alpine/apache2?arch=source",
"ecosystem": "Alpine:v3.19"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-37436.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.55-r0"
}
]
}
],
"package": {
"name": "apache2",
"purl": "pkg:apk/alpine/apache2?arch=source",
"ecosystem": "Alpine:v3.20"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-37436.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.55-r0"
}
]
}
],
"package": {
"name": "apache2",
"purl": "pkg:apk/alpine/apache2?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-37436.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.55-r0"
}
]
}
],
"package": {
"name": "apache2",
"purl": "pkg:apk/alpine/apache2?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-37436.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.55-r0"
}
]
}
],
"package": {
"name": "apache2",
"purl": "pkg:apk/alpine/apache2?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-37436.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.55-r0"
}
]
}
],
"package": {
"name": "apache2",
"purl": "pkg:apk/alpine/apache2?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-37436.json"
},
"ecosystem_specific": {}
}
],
"modified": "2026-10-15T07:17:54.242296572Z",
"provider": "osv",
"upstream": [
"CVE-2022-37436"
],
"references": [
"https://security.alpinelinux.org/vuln/CVE-2022-37436"
]
},
"related_cves": [
{
"value": "CVE-2022-37436",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 322005,
"published_at": "2023-01-17T20:15:11.67+00:00"
}