CVE-2022-37436: Apache HTTP Server response header truncation via malicious backend

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityCVSS 3.1 base score is 5.3 (medium) with only low integrity impact and no confidentiality or availability impact, though the high EPSS percentile warrants attention.

What it is

In Apache HTTP Server before 2.4.55, a malicious or compromised backend can cause response headers to be truncated early, pushing later headers into the response body. Because clients then treat those headers as body content, any security-relevant headers (for example, those carrying security policy) are not interpreted, weakening protections the client would otherwise apply.

Impact

An attacker controlling the backend can suppress security-relevant response headers, causing clients to skip protections they would normally enforce. The direct gain is limited to that header-integrity impact; the record shows no confidentiality or availability impact.

Attack surface

Reached over the network through the proxy path between Apache and a backend server; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The attacker must be able to influence the backend response, so the practical precondition is a malicious or compromised backend.

Exploitation

Not listed in CISA KEV and no public exploit or exploitation tags appear in the references, but EPSS is high at 0.60995 (99.1st percentile), indicating elevated predicted likelihood of exploitation activity.

What to do

• Upgrade Apache HTTP Server to 2.4.55 or later, which is the version line that fixes this issue.
• Apply the vendor advisory guidance at httpd.apache.org/security/vulnerabilities_24.html and track distribution backports (for example, the Gentoo GLSA).
• Do not route traffic through untrusted or third-party backend servers where possible, and treat backend responses as untrusted input.
• Where a proxy sits in front of backends, validate and normalize response headers before forwarding to clients.

Detection

• Inspect proxy and server logs for responses where expected security headers are missing or appear inside the response body.
• Monitor for anomalous backend response framing, such as header/body boundary shifts or truncated header blocks.
• Alert on client-side reports of missing security headers correlated with a specific backend.
• Review backend response sizes and header counts for deviations from baseline.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.