CVE-2015-3183

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 74.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-07-20 · updated 2026-06-17
Weakness: CWE-17

Description

The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.

Affected products

Apache HTTP Server: from 2.2.0 before 2.2.31; from 2.4.0 before 2.4.16 — fixed in 2.2.31, 2.4.16

How to fix

Upgrade to a fixed version: Apache HTTP Server 2.2.31, 2.4.16. Check the vendor advisory for mitigations.

References

http://httpd.apache.org/security/vulnerabilities_24.html
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html
http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html
http://marc.info/?l=bugtraq&m=144493176821532&w=2
http://rhn.redhat.com/errata/RHSA-2015-1666.html
http://rhn.redhat.com/errata/RHSA-2015-1667.html
http://rhn.redhat.com/errata/RHSA-2015-1668.html
http://rhn.redhat.com/errata/RHSA-2015-2661.html
http://rhn.redhat.com/errata/RHSA-2016-0061.html
http://rhn.redhat.com/errata/RHSA-2016-0062.html

Get alerted when CVE-2015-3183 or the next vulnerability affects your stack