CVE-2026-33523

Analyzed Analyzed - Analysis Complete

HTTP Response Splitting in Apache HTTP Server

Publication date: 2026-05-04

Last updated on: 2026-05-04

Assigner: Apache Software Foundation

Description

HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP Server: from through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-04

Last Modified

2026-05-04

Generated

2026-07-06

AI Q&A

2026-05-05

EPSS Evaluated

2026-07-05

NVD

CVE-2026-33523

Affected Vendors & Products

Vendor	Product	Version / Range
apache	http_server	From 2.4.0 (inc) to 2.4.67 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-443	This weakness can be found at CWE-113.

Attack-Flow Graph

Executive Summary

This vulnerability is an HTTP response splitting issue found in multiple Apache HTTP Server modules when used with untrusted or compromised backend servers.

It affects Apache HTTP Server versions up to 2.4.66 and allows attackers to manipulate HTTP responses by injecting malicious headers or content.

Users are advised to upgrade to version 2.4.67 to fix this vulnerability.

Impact Analysis

This vulnerability can allow attackers to perform HTTP response splitting attacks, which may lead to web cache poisoning, cross-site scripting (XSS), or other malicious activities.

The CVSS score of 6.5 indicates a medium severity with potential impacts on confidentiality and integrity, but no impact on availability.

Mitigation Strategies

Users are recommended to upgrade Apache HTTP Server to version 2.4.67, which fixes the HTTP response splitting vulnerability.

Hi! I’m here to help you understand CVE-2026-33523. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70