CVE-2022-22720: 
Apache HTTP Server vulnerability analysis and mitigation

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling. The vulnerability was discovered by James Kettle and assigned CVE-2022-22720. This issue affects Apache HTTP Server versions through 2.4.52 and was fixed in version 2.4.53 released in March 2022 (Apache Vulnerabilities).

The vulnerability has a CVSS v3.1 Base Score of 9.8 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue occurs when the server fails to properly close inbound connections after encountering errors while discarding the request body, which can lead to HTTP Request Smuggling attacks (NVD).

A successful exploitation of this vulnerability could allow an attacker to perform HTTP Request Smuggling attacks. This could potentially lead to request modification, cache poisoning, and bypass of access controls in the proxy server (Apache Vulnerabilities).

Users should upgrade to Apache HTTP Server version 2.4.53 or later which contains the fix for this vulnerability. The issue was addressed in the March 2022 security update (Apache Vulnerabilities).