Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2005-2088 Details

Description

The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://docs.info.apple.com/article.html?artnum=302847	CVE	Broken Link
http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html	CVE	Broken Link
http://marc.info/?l=apache-httpd-announce&m=112931556417329&w=3	CVE	Mailing ListThird Party Advisory
http://seclists.org/lists/bugtraq/2005/Jun/0025.html	CVE	Issue TrackingMailing ListThird Party Advisory
http://secunia.com/advisories/14530	CVE	Not Applicable
http://secunia.com/advisories/17319	CVE	Not Applicable
http://secunia.com/advisories/17487	CVE	Not Applicable
http://secunia.com/advisories/17813	CVE	Not Applicable
http://secunia.com/advisories/19072	CVE	Not Applicable
http://secunia.com/advisories/19073	CVE	Not Applicable
http://secunia.com/advisories/19185	CVE	Not Applicable
http://secunia.com/advisories/19317	CVE	Not Applicable
http://secunia.com/advisories/23074	CVE	Not Applicable
http://securityreason.com/securityalert/604	CVE	ExploitThird Party Advisory
http://securitytracker.com/id?1014323	CVE	Broken LinkThird Party AdvisoryVDB Entry
http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.600000	CVE	Third Party Advisory
https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E	CVE	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E	CVE	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E	CVE	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E	CVE	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3E	CVE	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/r734a07156abf332d5ab27fb91d9d962cacfef4f3681e44056f064fa8%40%3Ccvs.httpd.apache.org%3E	CVE	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E	CVE	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E	CVE	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E	CVE	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E	CVE	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E	CVE	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E	CVE	Mailing ListVendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11452	CVE	Broken LinkThird Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1237	CVE	Broken LinkThird Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1526	CVE	Broken LinkThird Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1629	CVE	Broken LinkThird Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A840	CVE	Broken LinkThird Party Advisory
https://secure-support.novell.com/KanisaPlatform/Publishing/741/3222109_f.SAL_Public.html	CVE	Broken Link
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102197-1	CVE	Broken Link
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1	CVE	Broken Link
http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm	CVE	Third Party Advisory
http://www-1.ibm.com/support/search.wss?rs=0&q=PK13959&apar=only	CVE	Broken LinkThird Party Advisory
http://www-1.ibm.com/support/search.wss?rs=0&q=PK16139&apar=only	CVE	Broken LinkThird Party Advisory
http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00612828	CVE	Broken Link
http://www.apache.org/dist/httpd/CHANGES_1.3	CVE	Broken LinkVendor Advisory
http://www.apache.org/dist/httpd/CHANGES_2.0	CVE	Broken LinkVendor Advisory
http://www.debian.org/security/2005/dsa-803	CVE	Mailing ListThird Party Advisory
http://www.debian.org/security/2005/dsa-805	CVE	Mailing ListThird Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:130	CVE	Third Party Advisory
http://www.novell.com/linux/security/advisories/2005_18_sr.html	CVE	Broken Link
http://www.novell.com/linux/security/advisories/2005_46_apache.html	CVE	Broken Link
http://www.redhat.com/support/errata/RHSA-2005-582.html	CVE	Broken LinkThird Party Advisory
http://www.securiteam.com/securityreviews/5GP0220G0U.html	CVE	Broken LinkExploit
http://www.securityfocus.com/archive/1/428138/100/0/threaded	CVE	Broken LinkThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/14106	CVE	Broken LinkThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/15647	CVE	Broken LinkThird Party AdvisoryVDB Entry
http://www.ubuntu.com/usn/usn-160-2	CVE	Broken Link
http://www.vupen.com/english/advisories/2005/2140	CVE	Broken LinkPermissions Required
http://www.vupen.com/english/advisories/2005/2659	CVE	Broken LinkPermissions Required
http://www.vupen.com/english/advisories/2006/0789	CVE	Broken LinkPermissions Required
http://www.vupen.com/english/advisories/2006/1018	CVE	Broken LinkPermissions Required
http://www.vupen.com/english/advisories/2006/4680	CVE	Broken LinkPermissions Required
http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf	CVE	Broken Link
http://docs.info.apple.com/article.html?artnum=302847	[email protected]	Broken Link
http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html	[email protected]	Broken Link
http://marc.info/?l=apache-httpd-announce&m=112931556417329&w=3	[email protected]	Mailing ListThird Party Advisory
http://seclists.org/lists/bugtraq/2005/Jun/0025.html	[email protected]	Issue TrackingMailing ListThird Party Advisory
http://secunia.com/advisories/14530	[email protected]	Not Applicable
http://secunia.com/advisories/17319	[email protected]	Not Applicable
http://secunia.com/advisories/17487	[email protected]	Not Applicable
http://secunia.com/advisories/17813	[email protected]	Not Applicable
http://secunia.com/advisories/19072	[email protected]	Not Applicable
http://secunia.com/advisories/19073	[email protected]	Not Applicable
http://secunia.com/advisories/19185	[email protected]	Not Applicable
http://secunia.com/advisories/19317	[email protected]	Not Applicable
http://secunia.com/advisories/23074	[email protected]	Not Applicable
http://securityreason.com/securityalert/604	[email protected]	ExploitThird Party Advisory
http://securitytracker.com/id?1014323	[email protected]	Broken LinkThird Party AdvisoryVDB Entry
http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.600000	[email protected]	Third Party Advisory
https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E	[email protected]	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E	[email protected]	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E	[email protected]	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E	[email protected]	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3E	[email protected]	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/r734a07156abf332d5ab27fb91d9d962cacfef4f3681e44056f064fa8%40%3Ccvs.httpd.apache.org%3E	[email protected]	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E	[email protected]	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E	[email protected]	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E	[email protected]	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E	[email protected]	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E	[email protected]	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E	[email protected]	Mailing ListVendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11452	[email protected]	Broken LinkThird Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1237	[email protected]	Broken LinkThird Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1526	[email protected]	Broken LinkThird Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1629	[email protected]	Broken LinkThird Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A840	[email protected]	Broken LinkThird Party Advisory
https://secure-support.novell.com/KanisaPlatform/Publishing/741/3222109_f.SAL_Public.html	[email protected]	Broken Link
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102197-1	[email protected]	Broken Link
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1	[email protected]	Broken Link
http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm	[email protected]	Third Party Advisory
http://www-1.ibm.com/support/search.wss?rs=0&q=PK13959&apar=only	[email protected]	Broken LinkThird Party Advisory
http://www-1.ibm.com/support/search.wss?rs=0&q=PK16139&apar=only	[email protected]	Broken LinkThird Party Advisory
http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00612828	[email protected]	Broken Link
http://www.apache.org/dist/httpd/CHANGES_1.3	[email protected]	Broken LinkVendor Advisory
http://www.apache.org/dist/httpd/CHANGES_2.0	[email protected]	Broken LinkVendor Advisory
http://www.debian.org/security/2005/dsa-803	[email protected]	Mailing ListThird Party Advisory
http://www.debian.org/security/2005/dsa-805	[email protected]	Mailing ListThird Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:130	[email protected]	Third Party Advisory
http://www.novell.com/linux/security/advisories/2005_18_sr.html	[email protected]	Broken Link
http://www.novell.com/linux/security/advisories/2005_46_apache.html	[email protected]	Broken Link
http://www.redhat.com/support/errata/RHSA-2005-582.html	[email protected]	Broken LinkThird Party Advisory
http://www.securiteam.com/securityreviews/5GP0220G0U.html	[email protected]	Broken LinkExploit
http://www.securityfocus.com/archive/1/428138/100/0/threaded	[email protected]	Broken LinkThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/14106	[email protected]	Broken LinkThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/15647	[email protected]	Broken LinkThird Party AdvisoryVDB Entry
http://www.ubuntu.com/usn/usn-160-2	[email protected]	Broken Link
http://www.vupen.com/english/advisories/2005/2140	[email protected]	Broken LinkPermissions Required
http://www.vupen.com/english/advisories/2005/2659	[email protected]	Broken LinkPermissions Required
http://www.vupen.com/english/advisories/2006/0789	[email protected]	Broken LinkPermissions Required
http://www.vupen.com/english/advisories/2006/1018	[email protected]	Broken LinkPermissions Required
http://www.vupen.com/english/advisories/2006/4680	[email protected]	Broken LinkPermissions Required
http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf	[email protected]	Broken Link

see all 118 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-444	Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')	[email protected]

Affected Products

Product	Versions
apache http server	>= 2.0.35, < 2.0.55
CPE cpe:2.3:a:apache:http_server:::::::: Remediation No remediation found in references.
debian debian linux	3.0 3.1
CPE cpe:2.3:o:debian:debian_linux:3.0:::::::* cpe:2.3:o:debian:debian_linux:3.1:::::::* Remediation No remediation found in references.

Change History

16 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 16, 2026		[email protected]
Nov 20, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Feb 9, 2024	Modified Analysis	[email protected]
Feb 13, 2023	CVE Modified	[email protected]
Sep 21, 2022	Modified Analysis	[email protected]
Jun 6, 2021	CVE Modified	[email protected]
Mar 30, 2021	CVE Modified	[email protected]
Apr 1, 2020	CVE Modified	[email protected]
Apr 1, 2020	CVE Modified	[email protected]
Aug 15, 2019	CVE Modified	[email protected]
Oct 19, 2018	CVE Modified	[email protected]
Oct 11, 2017	CVE Modified	[email protected]
Oct 18, 2016	CVE Modified	[email protected]
Jul 5, 2005	Initial Analysis	[email protected]