Pause-based desync in Apache HTTPD

Summary

important: HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier (CVE-2022-22720)

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

Acknowledgements: James Kettle <james.kettle portswigger.net>

Reported to security team: 2021-12-17 fixed by r1898692 in 2.4.x: 2022-03-07 Update 2.4.53 released: 2022-03-14 Affects: <=2.4.52

Link to Security Advisory: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-22720

While researching browser-powered desync attacks, I discovered that Apache was vulnerable to a pause-based desync.

This vulnerability is detailed in full in the whitepaper: https://portswigger.net/research/browser-powered-desync-attacks#pause

We've also published a vulnerable lab based on the finding: https://portswigger.net/web-security/request-smuggling/browser/pause-based-desync

The bounty will be donated to charity.