Security readout for executives and security teams
Plain-English summary
Apache Traffic Server versions 8.0.0 through 9.1.2 can mishandle HTTP/2 headers. A remote attacker could use this parsing weakness to cause request smuggling or cache poisoning, potentially exposing or altering content through the proxy/cache layer. The CVE bundle does not report known active exploitation.
Executive priority
Treat as a moderate-priority infrastructure exposure. It is not listed as actively exploited, but affected proxy/cache infrastructure can create broad data integrity and confidentiality risk if reachable and unpatched.
Technical view
The issue is improper input validation in ATS HTTP/2 request validation, classified as CWE-444. The CVSS 3.1 score is 6.8 with network attack vector, high attack complexity, no privileges required, user interaction required, and high confidentiality and integrity impact.
Likely exposure
Exposure is limited to environments running Apache Traffic Server 8.0.0 through 9.1.2, especially where ATS handles HTTP/2 traffic as a reverse proxy, cache, or intermediary.
Exploitation context
Sources say the flaw may enable request smuggling or cache poisoning. KEV is false in the bundle, and no cited source confirms active exploitation. Attack complexity is rated high, so practical exploitation likely depends on deployment-specific HTTP/2 handling and upstream behavior.
Researcher notes
The central research angle is HTTP/2 request validation and inconsistent interpretation across intermediary and origin components. The bundle does not provide patch details, exploit indicators, or deployment-specific preconditions, so validation should focus on version, role, HTTP/2 exposure, and vendor advisory status.
Mitigation direction
- Inventory Apache Traffic Server deployments and record exact versions.
- Prioritize systems that accept HTTP/2 traffic from untrusted networks.
- Apply Apache, Debian, Fedora, or platform vendor security updates.
- If updates are unavailable, check vendor guidance for supported temporary controls.
- Review cache and proxy configurations for unusually trusted upstream assumptions.
Validation and detection
- Confirm no Apache Traffic Server instance is in versions 8.0.0 through 9.1.2.
- Check OS package security advisories for applied ATS fixes.
- Verify HTTP/2 is only enabled where business-required.
- Review proxy/cache logs for unexplained cache poisoning or routing anomalies.
- Document whether ATS sits on internet-facing or internal-only paths.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-444: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-25763 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N1.65.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.8MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21CVE reference · x_refsource_MISC
- DSA-5206CVE reference · vendor-advisory, x_refsource_DEBIAN
- FEDORA-2022-9832c0c04bCVE reference · vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-23043f5a0bCVE reference · vendor-advisory, x_refsource_FEDORA
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.