CVE-2022-2255: Debian Linux

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing.

Affected products

• Debian Debian Linux: version 10.0 only
• Modwsgi Mod Wsgi: before 4.9.3 (fixed in 4.9.3)

Published 2022-08-25. Last modified 2026-06-17.