Request splitting via HTTP/2 method injection and mod_proxy
published August 16, 2021
CVSS
—
EPSS
46%
Percentile
98.8
In the wild
Unconfirmed
What it is
A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.
The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.46179 · 98.8th percentile
Published
2021-08-16T00:00Z
EPSS history
Timeline
16 AUG 00:00Z
Request splitting via HTTP/2 method injection and mod_proxy