CVE-2015-3183
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.
- EPSS
- 74% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-17, CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:http_server
References
- http://httpd.apache.org/security/vulnerabilities_24.html
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
- http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html