CVE-2023-27522 Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting

2023-03-0715:09:30

CWE-444

apache

www.cve.org

cve-2023-27522; apache http server; mod_proxy_uwsgi; http response splitting; special characters; origin response header; vulnerability; 2.4.30; 2.4.55; http response smuggling

AI Score

8.8

Confidence

High

EPSS

0.014

Percentile

86.4%

JSON

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55.

Special characters in the origin response header can truncate/split the response forwarded to the client.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache HTTP Server",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.4.55",
        "status": "affected",
        "version": "2.4.30",
        "versionType": "semver"
      }
    ]
  }
]